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IT certifications 


are stillimportantto some hiring 
managers, but many say that 
hands-on experience trumps 
book knowledge any day. 

SEE ‘CERTIFIABLE’ ON PAGE 35 
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Financial Services Wary of 
Outsourcing Key Projects 


Firms fear weakened 
control and privacy, 


backlash to job losses 


BY LUCAS MEARIAN 
NEW YORK 

IT managers interviewed last 
week mostly agreed with a 
Gartner Inc. prediction that 
less than 30% of financial ser- 
vices companies will be out- 
sourcing strategic projects by 


the end of next year. 

At the Gartner Financial 
Services Summit here, IT ex- 
ecutives said they do favor us- 
ing outsourcers for more rou- 
tine tasks like maintenance or 
call center operations, but not 
for important projects where 
strong oversight is essential. 

Though the Gartner report 
released at the conference 
suggests that IT organizations 

Outsourcing, page 47 
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Hurricane, Floods Put 
IT Staffs to the Test 


New Orleans tech workers relocate to higher 
ground and start trying to restore operations 


Disaster recovery 
works for some, but 
scope of calamity was 
difficult to prepare for 


BY LUCAS MEARIAN 
At 2 a.m. on Aug. 27, two days 
before Hurricane Katrina dev- 
astated the Gulf Coast, Tim 
Babco grabbed a red binder 
containing the latest version 
of SCP Pool Corp.’s disaster 
recovery plan, put his dog and 
cat in the car, locked up his 
house and drove 500 miles 
from Covington, La., to the 
company’s emergency opera- 
tions center in Dallas. 

Babco, senior director of IT 
at Covington-based SCP, a 
$1.3 billion wholesale distribu- 
tor of swimming pool sup- 
plies, had relocated his opera- 
tions on two earlier occasions 
when hurricanes threatened 
neighboring New Orleans. 
Both of those storms turned 
out to be near misses, but 
Babco said last week that the 
practice runs helped him fine- 
tune his plan for when the real 
thing finally hit. 

“People would be lying to 
say these things always go 
perfectly,” Babco said. “But 
has it succeeded in allowing 
our business operations to 
continue to buy, sell and dis- 
tribute products? It certainly 
has, and that’s what disaster 
recovery is all about.” 

However, the kind of disas- 

Katrina, page 4 








FLOODING in the wake of Katrina left much of New Orleans uninhabitable. 


BY MARC L. SONGINI 
AND TODD R. WEISS 


IT managers and staffers at 
New Orleans-based compa- 
nies worked last week to sal- 
vage their systems, data and 
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| Web sites, some not knowing 
| whether they still had viable 


businesses to support or homes 


| that they could return to. 


“We're not thinking of our- 
selves,” said Robert Leithman, 
president of Integrated Data 
Systems Inc., a systems inte- 
grator and hosting services 
provider. “It’s helpful not to 
have time to think about it.” 

Leithman’s company was 
one of many scrambling to 
maintain operations in the 
wake of the devastating flood- 
ing that followed Hurricane 
Katrina. In a catastrophe of 
such epic proportions, “even 
the best-laid plans go awry re- 
ally quickly,” said Leithman, 
who left New Orleans two 
days before the storm hit to go 
to a backup facility in Florida. 

Recovery, page 6 
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New Reasons to Do It Yourself 

In the Management section: When software licenses don’t 
work but offshore development services do, some maverick 
IT shops are deciding to build their own applications. 


Page 38 


LONTENTS 


Upgrades Without Downtime 

in the Technology section: Uprgrading a corporate 
network is never easy, especially when the organi- 
zation can’t afford downtime. Here are some tips 
from IT pros. Page 21 
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A new industry group tries to 
develop metrics for measur- 

ing the effectiveness of infor- 
mation security investments. 


The Zotob investigation 

reveals a connection between 
worm writers and gangs look- 
ing to profit from cybercrime. 


Global Dispatches: In India, a 
government-commissioned 
committee is proposing stiffer 
penalties for data theft. 


Q&A: Chris Zannetos, co- 
chairman of TechNet’s CEO 
Cyber Security Task Force, 
sees a need to coordinate IT 
security lobbying efforts. 


Washington’s King County 
takes another crack at ERP, 
hoping to learn from a failed 
$39 million project. 


14 IBM develops tools that can 
be used to manage SOAs. 


47 Agile programmers are warm- 
ing to the idea of using devel- 
opment tools. 





26 IT Gives Airlines a Lift. IT 
projects in the areas of cus- 
tomer service and mainte- 
nance automation can pay 
dividends for the cash- 
strapped airlines. 


: 28 Future Watch: Molecular Self- 
Assembly. Nanoscale circuits 
can build themselves, promis- 
ing to keep Moore’s Law alive 
for many years to come. 


: 30 Security Manager’s Journal: 


Starting Over, With Intrusion 
Detection. Mathias Thurman 
finds lots to keep him busy at 
his new job, and budget con- 
siderations put intrusion de- 
tection at the top of the list. 
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35 Certifiable. Lately, IT certifi- 
cations have lost some of their 
allure. Learn why — and what 
your alternatives are. 


40 ThinkTank. A benchmarking 
study offers proof that IT 
complexity — too much cus- 
tomization, too many data 
silos and too many vendors — 
dramatically increases back- 
office costs. Plus, we review a 
book that takes a nonpolitical 
look at outsourcing. 


42 Career Watch. John Parkin- 
son of Capgemini answers 
readers’ questions about lead- 
ing an IT department and 
avoiding a dead-end career 
path. Plus, get the scoop on 
pre-employment testing ser- 
vices, and find out what work- 
ers think about their compa- 
nies’ leaders. 


6 On the Mark: Mark Hall 1 re- 
ports on two record compa- 
nies that have joined forces to 
build a shared, Java-based ap- 
plication for managing royalty 
payments. 


Don Tennant was dumbfound- 
ed by HP’s explanation of its 
indecisiveness about posi- 
poning a conference set for 
New Orleans just two weeks 
after Hurricane Katrina hit. 


Thornton A. May has advice 
on how IT should get its 
“story” out to the business. 


John D. Halamka keeps up 
with his many jobs through the 
efficient use of technology. 


32 Ken Karacsony says the pro- 
liferation of extract, transform 
and load processes is a sign of 
poor data management. 


44 Paul Glen thinks technical 
people can become better 
communicators by moderat- 
ing their verbal torrent to a 
trickle of well-chosen words. 


48 Frankly Speaking: Frank 
Hayes offers some hope to 
techies who just don’t get 
the business side of things: a 
way of looking at business as 
if it were poorly designed 
technology. 
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Outsourcing Leaders Speak Up 

1T MANAGEMENT: On the scene in Manila, 
Richard Mills of Chalre Associates finds 
some offshore outsourcing managers who 
are willing to talk openly about their experi- 


ences. @ QuickLink 56424 


Easy Fixes for Windows XP Woes 
OPERATING SYSTEMS: This excerpt from Bri- 
an Culp’s Spring Into Windows XP Service 
Pack 2 offers advice on diagnosing slow per- 
formance, solving program incompatibility 
problems and disabling pop-up balloons. 


@ QuickLink 26950 
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PRIVACY: Companies are making progress, 
but more work is needed to prepare for pos- 
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SPECIAL COVERAGE 
COPING WITH KATRINA 


B WIDESPREAD DESTRUCTION, evident at this Gulfport, Miss., housing complex, left communications systems in disarray. 


Telecommunications Slowly Improving, 
But Problems Remain in New Orleans 


Vendors unsure 
when service will 
be fully restored 
BY MATT HAMBLEN 
ELLULAR and other 
communications 
services were gradu- 
ally improving in the 
Gulf Coast region late last 
week, but telecommunications 
companies said they still 
couldn’t gain access to most 


parts of New Orleans to make 
repairs to their networks. 

On Thursday, Sprint Corp., 
Cingular Wireless LLC, Veri- 
zon Wireless and BellSouth 
Corp. all reported that their 
repair crews were in holding 
patterns around New Orleans. 
Cingular said on Friday that it 
had begun deploying crews 
into the city but that access 
was still very restricted. 

Telecommunications capa- 
bilities had improved in cities 


such as Baton Rouge, Mobile, 
Ala., and Pensacola, Fla., since 
the immediate aftermath of 
Hurricane Katrina, according 
to spokesmen for the carriers. 
The companies are all rely- 
ing on backup generators or 
portable ones carried on panel 
trucks along with cellular 
transceivers. They said that 
when possible, they’re increas- 
ing power to rooftop cell sites 
in New Orleans in order to 
provide some level of services 


inside the stricken city. 

Despite a massive effort 
with thousands of repair 
workers on the scene, the situ- 
ation is obviously difficult, 
said Jeff Kagan, an indepen- 
dent telecommunications ana- 
lyst based in Atlanta. 

“All the carriers are still in 


| survival mode,” he said. “Some 


cities are better than others, 
but it is all one big mess. This 
is much worse than the 9/11 
emergency. It isn’t just a part 
of a city like New York. It’s the 
entire Southeast that has been 
devastated.” 


Not Completely Wireless 
Typically, only a small por- 
tion of a cellular call is carried 
over wireless links, with cell 
sites connecting to switching 
stations and the rest of a net- 
work via T1 or fiber-optic 
cables. “Flooding has its most 
dramatic effect on land lines, 
such as Tls and fiber,” said 
Verizon Wireless spokesman 


BellSouth said that 
of about 1 million 
land-line phones that 
were knocked out of 
service in Louisiana, 
eiOM8l8lORarts 

yet FeCK| 
midday on Thursday. 


tor 
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Patrick Kimball. 

Bill Oliver, president of Bell- 
South’s Louisiana operations, 
said that even in areas where 
service had been restored, net- 
work congestion was high and 
land-line users often were un- 
able to complete calls. Bell- 
South and other vendors 
urged users to consider text 
messaging as an alternative to 
voice calls, partly because it 
requires less bandwidth. 

None of the carriers would 


| predict when full service will 


resume, but Oliver pointed to 
“key fiber breaks” in south- 
eastern Louisiana that will 
take more resources to repair. 

Some companies in the Gulf 
Coast region are relying on in- 
ternal communications back- 
up plans in the storm’s wake. 

For example, Siemens En- 
terprise Networks is working 
with a power utility in Missis- 
sippi that has equipped its re- 
pair crews with voice-over-IP 
phones so they can make 
wireless calls via a satellite 
network, said Tim Perez, a 
sales director at the division of 
Siemens Communications Inc. 

Perez, who wouldn't identi- 
fy the utility, said the VoIP 
system has been the main 
means of voice communica- 
tions for utility crew supervi- 
sors in the field, supplement- 
ed by BlackBerry handhelds 
from Research In Motion Ltd. 
for e-mail access. @ 56581 





Continued from page 1 


Katrina 


ter recovery planning done by 
Babco isn’t universal — espe- 
cially for a calamity as massive 
as last week’s. Gartner Inc. an- 
alyst Simon Mingay said that 
about 40% of Fortune 1,000 
companies aren’t prepared for 
a regional disaster. And small 
and midsize businesses are 
even less ready, he added. 
“Obviously, we’re looking at 
a level of devastation here that 
few would have considered,” 
Mingay said. “But most still 
believe that these are things 
that don’t happen to them.” 
Mingay said companies that 
have prepared properly for 





disasters, such as SCP, have 


| extensive emergency commu- 


nications plans, hot sites from 
which they can continue busi- 
ness operations for an extend- 
ed period and some level of IT 
systems redundancy outside 
of their headquarters region. 

But even companies that are 
well-prepared might not take 
into account a crisis of the 
magnitude as the one spawned 
by Katrina and the flooding 
that followed the storm. 

For example, John Wade, 
CIO at Saint Luke’s Health 
System Inc. in Kansas City, 
Mo., said his contract with a 
disaster recovery vendor al- 
lows the IT department to 
work out of a hot-site facility 
for up to six weeks. But ina 





disaster similar to Katrina, the 
six-week limit could “pose a 
hardship,” Wade said. 

Joe Hartman, an application 
development manager at 
HydroChem Industrial Ser- 
vices Inc. in the Houston sub- 
urb of Deer Park, said the 
company’s disaster recovery 
plan involves moving corpo- 
rate operations to facilities on 
the city’s north side. “Anything 
that would completely wipe 
out Houston would leave us in 
a bad way,” he added. 

Babco said SCP’s headquar- 
ters were unscathed by Katri- 
na and the flooding that fol- 
lowed but lost all data and 
voice communications links. 
Fifteen of the company’s 40 IT 
workers have relocated to Dal- 





las for now, while another 15 
were dispersed among offices 
around the country. 

Three years ago, Babco de- 
cided to flip-flop SCP’s prima- 
ry and secondary data centers, 
placing its critical systems in 
the Dallas facility, which is run 
by Houston-based VeriCenter 
Inc. He also created an IT dis- 
aster recovery team for func- 
tions such as coordinating 
help desk services and relocat- 
ing hardware. In addition, SCP 
has set up an internal busi- 
ness-continuity Web site that 
posts corporate alerts and pro- 
vides toll-free numbers and an 
extensive list of employee 
contact information. 

Not everything went com- 
pletely smoothly last week. On 





Tuesday, Babco made an un- 
planned trip from Dallas to 
SCP’s headquarters to retrieve 
12 application servers, includ- 
ing ones supporting human re- 
sources and e-mail. 

He also said he has been un- 
able to get a response from 
Boston-based Iron Mountain 
Inc., which handles off-site 
data storage for SCP. The area 
around Iron Mountain’s Ken- 
ner, La., facility is inaccessible, 
said Babco, who added that he 
would have liked to have had 
SCP’s backup tapes sent to 
Dallas in advance of the storm. 

“They’ve not been able to 
provide us any information 
about when they will be able 
to get tapes out of their facili- 
ty,” Babco said. “I think they 
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Retailers Unsure About Status of Stores, Systems 


IT issues take a back seat to concerns 
about workers, damage and looting 





BY CAROL SLIWA 
HREE OF Burlington 
Coat Factory Ware- 
house Corp.’s retail 
stores in Louisiana, 
and another one in Alabama, 
were closed in the aftermath 
of Hurricane Katrina’s rav- 


aging of the Gulf Coast. And at | 


4 | Nobody can 
get close to 
those stores. 


MICHAEL PRINCE. CIO, 
BURLINGTON COAT FACTORY 


midweek, Mike 
Prince, CIO at 
the Burlington, 
NJ.-based chain, 
didn’t know if 
the buildings — 
and their IT sys- 
tems — were 
still standing. 
“Nobody can get close to 
the stores,” Prince said. He 
had heard reports that two of 
the stores in the New Orleans 
area were underwater. But he 
wasn’t able to confirm the in- 
formation because of the lack 
of power and communications 
capabilities after the storm. 
Likewise, Circuit City Stores 
Inc. couldn't get to four of its 
stores the day after Katrina 
swept through, according to 
a spokeswoman. The Home 
Depot Inc. said six stores re- 
mained closed late last week 
because of inaccessibility. A 


weren't proactive in seeing the 
event looming and getting the 
tapes out of harm’s way.” He 
vowed to switch to a different 
storage archiving vendor. 

Ken Rubin, senior vice pres- 
ident of marketing at Iron 
Mountain, said the company 
moved requested data tapes to 
customers’ facilities beginning 
Aug. 26. It also put the tapes in 
its sites on higher shelves. 
“We don’t know once the lev- 
ees broke what impact or not 
there is to any of the contents 
of the buildings,” Rubin said. 
“We're trying to get in.” 

Richard Kerley, chief oper- 
ating officer at Shutts & 
Bowen LLP, said three of the 
Miami-based law firm’s offices 
in Florida were hit by multiple 





Lowe’s Companies Inc. 
spokeswoman said that five 
stores were closed and that 
telecommunications problems 
were making it hard to reach 
stores and local employees. 

“The immediate issues 
these guys are wrestling with 
are store destruction, looting 
and the loss of 
power,” said 
Gartner Inc. an- 
alyst Jeff Roster. 
“It’s a store op- 
erations issue 
more than an IT 
issue.” 

But retailers 
did take IT into account in ad- 
vance of the storm. For exam- 
ple, one national specialty re- 
tailer closed eight of its 10 
Florida facilities the day be- 
fore Katrina hit to give em- 
ployees enough time to get 


| home to their families, said 


the company’s vice president 
of operations, who asked not 
to be named. He said the clos- 
ings also allowed the retailer 
to complete an orderly shut- 
down of its store systems, 
based on a set of procedures 
instituted after last year’s se- 


| ries of hurricanes in Florida. 


hurricanes last year. “We 


could have had a situation 


where our main [data center] 
site in Miami was taken out, 
and the cold site in Orlando 
was taken out, and we were 
decapitated,” Kerley said. 

Six months ago, Shutts & 
Bowan signed up for data cen- 
ter space in a reinforced con- 
crete bunker owned by Terre- 
mark Worldwide Inc. in Mia- 
mi. Kerley said the law firm’s 
neighbors in the bunker in- 
clude the State Department, 
the Department of Defense 
and the Federal Emergency 
Management Agency. 

@ 56588 
Carol Sliwa contributed to 
this report. 





Katrina swept through Jack- 
son, Miss., where Saks Inc.’s 
data center is located. The 
company said it lost power for 
three days, but emergency 
generators kept the business 
running, and it didn’t have to 
activate its disaster recovery 
plan and relocate operations. 

More commonly, retailers 


| tried to monitor Katrina’s af- 


tereffects from farther afield. 
For example, Food Lion LLC, a 
Salisbury, N.C.-based grocer, 
kept key employees informed 
about the status of 50 affected 
stores, most of them located in 
Tennessee, through a “disaster 
tracker” application it devel- 
oped two years ago. 

Recognizing that an earlier 
application based on e-mail 
and spreadsheets was hard to 
access on a broad basis, Food 
Lion’s developers brought to- 
gether a cross-functional team 
of end users to set require- 
ments for the disaster tracker. 
The group analyzed disaster- 
related business processes, 
action plans, workflows and 
communications, said Doug 
Miller, the company’s director 
of store systems. 

The developers then tried to 
automate as much of the dis- 
aster response as they could 
through the Web-based appli- 
cation, which was written in 





Microsoft Corp.’s Visual Basic 
-Net language. Each type of 
event has a set of tasks that 
apply to different departments 
and employees, Miller said. 
Network monitoring lets 
everyone know which stores 


| ; 
are down, and a central view 


helps employees spot which 


Hot Sites Get Heavy Usage 


SAINT LUKE’S HEALTH SYSTEM 
conducted a test of its disaster 
recovery procedures in August 
and planned to do another one 
late this month, said C!O John 
Wade. But in a sign of Hurricane 
Katrina's effect on IT operations, 
the health care provider's hot- 
site vendor canceled the Sep- 
tember test last week because 
so many of its other clients have 
declared disaster situations, 
Wade said. 

Bob DiLossi, manager of Sun- 
Gard Data Systems Inc.'s crisis 
management center, said the 
Wayne, Pa.-based vendor has 


contracts for disaster recovery 
services with 146 companies in 
the area hit by Katrina. Of those, 
24 had declared disasters as of 
Thursday, and 120 had issued 
disaster alerts, DiLossi said. 

SunGard has three emer- 
gency data centers in Texas, and 
it's sending mobile data centers 
to the Gulf Coast region. In addi- 
tion, DiLossi said SunGard has 
been trying to reach out to cus- 
tomers in the New Orleans and 
Biloxi, Miss., areas. But it has 
had trouble making contact with 
them because of telecommuni- 
cations outages. 


BIS atau CROm Use R eur mL commu lirlas 


| stores need a generator or a 
| refrigeration truck. 
In previous disasters, Miller 
| said, the use of the software 
| resulted in “situations where 
we were the only grocery 
| store in a particular neighbor- 
hood that was operating.” 


| @56593 


Belinda Wilson, executive di- 
rector of business continuity ser- 
vices for the Americas region at 
Hewlett-Packard Co., said most 
of the customers seeking HP’s 
help are asking for offices and 
work areas that they can use. 
“It's really been tough,” she said. 
“It’s just chaos.” 

The job ahead appears enor- 
mous for IT, said Bill Oates, CiO 
at Starwood Hotels and Resorts 
Worldwide Inc. Disaster plan- 
ning typically “isn’t assuming 
that you're going to have extend- 
ed problems” of the sort caused 
by Katrina, he said. 

~ Lucas Mearian, Carol Sliwa 
and Todd R. Weiss 
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Recovery 

The trip, which normally 
takes about five hours, was a 
15-hour ordeal. One of the 
company’s engineers, who 
thought he was in a safe loca- 
tion, saw the building’s roof 
ripped off by winds. And even 
though Integrated Data Sys- 
tems had distributed its servers 
and data among offices in sev- 
eral cities following the Sept. 11 
terrorist attacks, the loss of 
telecommunications capabili- 
ties in the areas waylaid by Ka- 
trina complicated its efforts to 
restore customers’ systems. 

One of the company’s host- 
ing centers, located near the 
stricken Superdome in New 
Orleans, remained inaccessi- 
ble late last week. Another, 
which is set up in a bunker in 
nearby Metairie, La., was live 
but lacked any external con- 
nectivity, Leithman said. 

Still, his team had restored 
basic Web access, instant mes- 
saging and Hotmail services 
and was doing work for corpo- 
rate clients such as McIlhenny 
Co., the New Orleans-based 
maker of Tabasco sauce. Inte- 
grated Data Systems set up a 
temporary Web site for Mcll- 
henny and provided e-mail ac- 
cess to its employees. “Things 
are far from normal, but at 
least we’re getting the sem- 





blance of it,” Leithman said. 

The situation was similar 
for the IT staff that supports 
the three hotels operated in 
New Orleans by Starwood 
Hotels and Resorts Worldwide 
Inc., said IT executives at 
the White Plains, N.Y.-based 
company. 

As the storm approached, 
four IT workers moved servers 
and other equipment from the 
ground floors of the hotels to 
higher ones. They also did ex- 
tra backups of on-site data, in- 
cluding catering contracts and 
sales information for upcoming 





conventions and meetings. In 
addition, the staffers hooked up 
phones and computers in ball- 
rooms, where stranded guests 
were moved for safety reasons. 

By Tuesday, when it became 
obvious that the damage to the 
city from the hurricane and 
the flooding wouldn't be re- 
versed quickly, the IT team 
began preparing to shuttle 
copies of the hotels’ data to a 
Starwood-owned Westin hotel 
in Atlanta, where a remote of- 
fice is being set up. 

Mark McBeth, director of 
IT for North America at Star- 


HP Forced to Put Off User Conference 


Bowing to the flooding catastro- 
phe that has befallen New Or- 
leans, Hewlett-Packard Co. 
postponed the inaugural HP 
Technology Forum user confer- 
ence it was scheduled to hold in 
the city next week. 

HP initially said in a statement 
posted on the conference Web 
site that it was monitoring the sit- 
uation in New Orleans and as- 
sessing the viability of going 
ahead with the event. But as the 
extent of the flooding became 
apparent, HP updated the state- 
ment, saying it was working “to 
determine a time in the fall when 
we can host the conference.” 

HP didn’t indicate where the 
conference might be held. The 


Flooding Complicates 
Relief Agency’s IT Plan 


BY TODD R. WEISS 

Before Hurricane Katrina 
struck the Gulf Coast, the 
American Red Cross made 
plans to quickly deploy mobile 
servers, satellite communica- 
tions equipment and other IT 
gear in affected areas to sup- 
port its efforts to help storm 
victims begin piecing their 
lives back together. 

But the extensive flooding 
in New Orleans and the gov- 
ernment’s plan to evacuate 
residents from the chaotic city 
complicated matters for the 





relief agency. The Red Cross 
last week was still working out 
plans for distributing much of 
the equipment it had staged in 
areas outside of the storm’s 
projected path as Katrina ap- 
proached the southern U.S. 
The equipment that the Red 
Cross had available included 
nine specially designed Ford 
Excursion sport utility vehi- 
cles equipped with various ra- 
dio systems. The technology 
lets relief workers communi- 
cate on a wide range of fre- 
quencies across disaster areas, 





company said it will announce 
the details of a new plan for HP 
Technology Forum 2005 by Fri- 
day. HP added that it’s indefi- 
nitely extending the cancellation 
period for would-be attendees in 
order to give users time to de- 
cide whether they can go to the 
rescheduled conference. 

All hotel reservations that were 
booked in New Orleans through 
the conference Web site will be 
automatically canceled without 
financial penalty, HP said. The 
company is also working with air- 
lines to transfer any nonrefund- 
able airline tickets so they can be 
used to get to the conference 
when it finally takes place. 

The HP Technology Forum is 


said Jason Wiltrout, a network 
engineer at the Washington- 
based Red Cross. 

The Emergency Communi- 
cations Response Vehicles 
(ECRV) include generator- 
equipped satellite dishes that 
can help establish communi- 
cations in the absence of 
working phone lines and cell 
phone towers, Wiltrout said. 
Each of the ECRVs also has 10 
voice-over-IP satellite phones 
and at least the same number 
of laptop PCs with wireless 
connections, he added. 

The Red Cross will also use 
IP-based fax machines and 
mobile servers built into con- 
tainers that are similar to a 
pair of shipping crates, Wil- 
trout said. Each unit, which in- 








SPECIAL COVERAGE 
COPING WITH KATRINA = 


wood, said business users need 
the data so they can work with 
customers to move scheduled 
events to other locations. He 
and Starwood CIO Bill Oates 
praised the staffers in New Or- 
leans for their ability to deal 
with the data-retention issues 


| as well as the IT needs of 


guests and other hotel employ- 
ees. “You just sort of cope,” 
McBeth said. “The team was 
dealing with a crisis, and they 
don’t even know if their own 
homes are OK.” 

Brad Brewster, founder and 
creative director of New Or- 


the first general user conference 
sponsored by HP itself. Encom- 
pass, an independent HP user 
group, is due to jointly manage 
the conference with the vendor, 
and the OpenView Forum Inter- 
national and ITUG user groups 
each have said they plan to have 
a presence at the event. 

The disaster in New Orleans 
will also affect the Service & 
Support Professionals Associa- 
tion, a San Diego-based trade 
group for IT vendors and other 
companies with technical sup- 
port and field service operations. 
The SSPA said it was working to 
“solidify the details” of its fall 
conference, which was sched- 
uled to be held in New Orleans 
starting Oct. 9. 

- Craig Stedman 
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supplies in advance of the hurricane. 


cludes a server, a Cisco Sys- 
tems Inc. router and switch, a 
keyboard and a monitor, will 
enable the agency to keep 
records on disaster victims 
receiving aid from Red Cross 
workers. 

Martin Franke, executive di- 
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leans-based Bent Media Inc., 
said the interactive multime- 
dia and marketing services 
firm’s offices were surrounded 
by five feet of water. Brewster 
temporarily relocated his 
servers to a makeshift office 
in West Monroe, La. As of 
Thursday, his 13 employees 
were scattered in hotels or 
with friends, or were still in 


| transit to safe locations. 


Brewster was busy trying to 
contact clients to see what 
they needed. One of Bent Me- 
dia’s businesses is managing 
Web sites for companies, 
some of which were also lo- 
cated in New Orleans. Clients 
that depend on online transac- 
tions want to post messages to 
customers on their sites im- 
mediately, Brewster said. Oth- 
ers are just focused for now on 
messaging employees or es- 
tablishing an intranet. 

“Many cannot do business,” 
Brewster said. “They don’t 
know where their employees 
are. Some business facilities 
may be damaged or under- 
water and destroyed.” 

With his own company’s 
intellectual assets in hand, 
Brewster expects Bent Media 
to continue working as a virtu- 
al organization in the short 
term. “Our clients need us, 
and like anyone, we need rev- 
enue,” he said. “And that be- 
comes even more important 
given our situation.” @ 56595 


rector of chapter information 
systems at the Red Cross, said 
relief workers can use the lap- 
tops in the ECRVs to collect 
names, addresses and other 
information from victims. The 
data is then transmitted wire- 
lessly via the portable servers 
to a central database that’s 
tied to CRM applications de- 
veloped by Siebel Systems Inc. 
Using the central database, 
the agency can issue debit 
cards to victims to provide 
them with fixed amounts of 
emergency funds for housing, 
clothing, food and other essen- 
tials, Franke said. @ 56592 


To donate money to help the victims of 
Hurricane Katrina, call 1-800-HELP- 
NOW, or go to www.redcross.org. 
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HP PROLIANT BL20p G3 BLADE SERVER 


with ProLiant Essentials Management Software 
Up to 2 Intel® Xeon™ Processors (3.60GHz/2MB) 
~ High density: Up to 48 servers per rack 
- Flexible/Open: Integrates with existing infrastructure 
- HP Systems Insight Manager™: Web-based networked 
management through a single console 
Rapid Deployment Pack: For ease of depi and 
ongoing provisioning and reprovisioning 
+ Integrated Cisco or Nortel switch options D t ms before tt { r. Plu Ss, yO 
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HP STORAGEWORKS MSA1500cs 


Get 2TB of Storage Free ($2,800 Value)’ 

- Up to 24TB of capacity (96 250GB SATA drives) 

- Up to 16TB of capacity (56 300GB SCSI drives) 

~ Ability to mix SCS! and Serial ATA enclosures 
for greater flexibility 

+ 2GB/1GB Fibre connections to host 


1. Intel's numbering is not a measure of higher performance. 2. Receive up to 2TB of storage free with purchase of HP StorageWorks Modular Smart Array 1500cs devices. Offer valid through 10/31/05. 3. Save $750 instantly on the purchase of a BladeSystem pClass 1U power enclosure solution. Offer valid 
through 10/31/05. All offers available from HP Direct and participating resellers. Prices shown are HP Direct prices, are subject to change and do not include applicable state and local sales tax or shipping to recipient's destination. Reseller prices may vary. See Web site for full details. Photography may not accurately 
Tepresent exact configurations priced. Associated values represent HP published list price. Intel, Intel Inside, the Intel Inside Logo and Inte! Xeon are trademarks or registered trademarks of intel Corporation or its subsidiaries in the United States and other countries. ( 
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Glaxo Signs $100M 
Outsourcing Pact 


GlaxoSmithKline PLC and Affiliat- 
ed Computer Services Inc. have 
signed a five-year, $100 million 
outsourcing contract. Under the 
agreement, ACS will provide mon- 
itoring and management services 
for more than 5,000 Unix, Wintel, 
0S/390 mainframe and OpenVMS 
servers in the pharmaceutical 
firm’s data centers in the U.S. 

and the U.K. 


Massachusetts May 
Replace Office Suite 


The Massachusetts state govern- 
ment’s IT operation has proposed 
a plan to phase out use of Micro- 
soft Corp.’s Office software in 
favor of office productivity suites 
that support an open-document 
format from the Organization for 
the Advancement of Structured 
information Standards. Suites 
that support the open-source 
format include OpenOffice, Star- 
Office, KOffice and IBM Workplace. 


Intel Files Response 
To AMD Charges 


In a filing in the U.S. District Court 
in Delaware, Intel Corp. formally 
responded to an antitrust com- 
plaint lodged by rival Advanced 
Micro Devices Inc. in June. In its 
statement, Intel denied that it vio- 
lated any laws and accused AMD 
of trying to shield itself from com- 
petition. AMD charged that intel 
illegally uses its position as a dom- 
inant processor supplier. 


Judge Nixes SEC 


Complaint vs. Siebel 


AUS. Securities and Exchange 
Commission complaint against 
Siebel Systems Inc. charging that 
the company violated disclosure 
rules has been dismissed by a 
federal judge. Judge George 
Daniels ruled that the SEC over- 
reached by excessively scrutiniz- 
ing vague comments made by 
Siebel executives at a dinner 
meeting with analysts. 
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Music Labels Singing 
New Tune for .. . 


. .. business process management. Rivals Universal 
Music Group and Warner Music Group have gotten 
together with venture capitalist Lightspeed Venture 
Partners and BPM vendor Exigen Group to form 
Royalty Services LP, which will create a shared 


application 
that can cal- 
culate royal- 
ty payments 
to musicians 
and copy- 
right hold- 
ers. Joe De- 
Tullio, CEO 
of the New 
York-based 
joint ven- 
ture, is a former Universal 
Music CIO. The approach be- 
ing taken by Royalty Services 
is “a different model than 
what I’ve been doing in IT for 
the past 20 years,” DeTullio 
says. The new model has Uni- 
versal and Warner 
sharing the develop- 
ment costs and risks 
for what they’re call- 
ing a shared royalty 
platform, or SRP. The 
project, which began 
in July 2004, is due to 
produce alpha code in 
November and a final 
release late next year 
or in early 2007. Be- 
fore it’s complete, the 
initiative will con- 
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sume tens of millions of dol- 
lars, DeTullio says. However, 
he claims that once it’s in 
production, the application 
will “provide more than $100 
million in value to Universal 
and Warner.” The anticipated 
value comes from eliminating 
the enormous complexity in- 
volved in calculating royalties 
on thousands of contracts 
signed over many decades 
with countless artists and 
copyright holders. In addi- 
tion, the SRP will be able to 
calculate the royalty differ- 
ences based on how revenues 
are generated — for example, 
digital downloads vs. product 
sales. 

So far, more than 5 
million business rules 
have been created in 
the SRP, says Mark 
Christiansen, vice 
president of market- 
ing at San Francisco- 
based Exigen. Ac- 
cording to DeTullio, 
the new application 
will replace existing 
royalty systems that 
are mainframe-based 





and run Cobol code “that’s 
been updated, enhanced, 
morphed and transformed for 
over 20 years,” he says. Exi- 
gen’s Java-based BPM soft- 
ware runs on either Unix or 
Linux. He says Royalty Ser- 
vices will also seek to work 
with other music labels or 
entertainment-based royalty- 
processing businesses, such 
as book publishers, once the 
SRP is in production. Christ- 
iansen argues that royalty 
payments are “just another 
back-office thing” and don’t 
help entertainment compa- 
nies differentiate themselves. 
So, his argument goes, users 
might all just as well be sing- 
ing from the same back-office 
hymnal. 


IT patching process 

is full of holes. . . 

. ..a vendor survey reveals. 
Help desk software vendor 
SupportSoft Inc. used Quality 
Research Associates in Foster 
City, Calif., to poll 112 desktop 


systems 


managers, 
168 IT help 
Lira att l es) 
Ele) Oy mV ULL) 


desk man- 
agers and 
management 
rola) 


369 users in 

companies 

with 5,000 
TT eae or more em- 

tala ployees to 

determine 
how their patch management 
processes were working. Not 
too well, concludes Bruce 
Mowery, vice president of 
marketing at Redwood City, 
Calif.-based SupportSoft. For 
example, 55% of all the IT 
managers surveyed said they 
didn’t know whether the 
patches that they’ve deployed 
actually worked. “They’re in 
the dark until something bad 
happens,” says Mowery. 


Butter-fingered end 
users can get... 

. .. their hands on a sturdy 
laptop. Itronix Corp., a Spo- 
kane, Wash.-based maker of 
ruggedized computers for the 
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HOT TECHNOLOGY TRENDS, NEW PRODUCT 
NEWS AND INDUSTRY BUZZ BY MARK HALL 


military and other rough-and- 
tumble users, this week is re- 
leasing its semirugged VR-1 
laptop, 

which is 
designed 

for techni- 
cians who 

work in 

the field. 
Matthew 
Gerber, se- 

nior vice 
president 

for product line 
management at Itronix, says 
the unit comes with Wi-Fi, 
Bluetooth, cellular and Global 
Positioning System capabili- 
ties. It also includes smart- 
card access and a removable 
hard drive. In addition, the 
VR-1 meets military specifica- 
tions for temperature, vibra- 
tion and humidity. The Win- 
dows XP-based laptop starts 
at $3,329. 


Corporate IT is slow 

to deploy... 

. .. applications that use the 
Real Simple Syndication (RSS) 
protocol. That’s because it 
lacks security, claims Andrew 
Nash, chief technology offi- 


cer at Reac- 
i 


tivity Inc. 

in Belmont, 

Calif. Ac- 

cording to eae 

Nash, IT Tia ae 

subscribing to 

RSS feeds, says 
the Pew Internet 


managers 
see RSS as 
& American 
Micaela 


Itronix’s VR-1 


an ideal 


communi- 
cate sensi- 
tive information to cus- 
tomers, supply chain partners 
and others, but they worry 
because the protocol is open 
to tampering. So his company 
has added secure RSS com- 
munications to Version 4.2 of 
the software that comes with 
its Reactivity XML Gateway 
4.2 appliance. The enhance- 
ment authenticates requester 
information, encrypts RSS 
feeds and provides an audit 
trail of transactions. @ 56548 
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BMC CFO Resigns 
After 17 Months 


George Harrington has resigned 
as chief financial officer at BMC 
Software Inc. He was replaced 
on an interim basis by Stephen 
Solcher, who has been the com- 
pany’s treasurer since 1992. 
BMC said Harrington's resigna- 
tion wasn’t tied to any financial 
irregularities. Harrington joined 
BMC 17 months ago from IBM. 


StorageTek, Deloitte 


Enter Partnership 


Deloitte Consulting LLP and Stor- 
age Technology Corp., which is 
now owned by Sun Microsystems 
Inc., have agreed to jointly pro- 
vide a service to help companies 
comply with data storage and 
archival regulations such as those 
included in the Sarbanes-Oxley 
Act and the Health Insurance 
Portability and Accountability Act. 
The service ranges in price from 
$500,000 to $1.5 million-plus. 


Microsoft Acquires 
VoIP Technology 


Microsoft Corp. has acquired 
Teleo Inc., a developer of services 
and technology that allow users to 
make and receive voice phone 
calls on their PCs via the Internet. 
Microsoft said it plans to incorpo- 
rate Teleo’s VoIP technology into 
its own software and Web appli- 
cations to upgrade online services 
at MSN, including MSN Messen- 
ger. A timetable for the integra- 
tion wasn’t disclosed. 


Flaws Revealed in 
Adobe Version Cue 


Two new security flaws were re- 
vealed in Adobe Systems Inc.’s 
Version Cue software. They were 
the second and third flaws discov- 
ered in the past two weeks, ac- 
cording to security consulting firm 
iDefense Inc. Both flaws allow lo- 
cal attackers to gain access to 
machines through the file version 
manager in Adobe Creative Suite. 
Adobe said the flaw affects only 
early versions of the software. 


| 
| 





NEWS 


'New Group Plans 


Security Metrics 


| Organization is the 


latest to take stab 


at creating standard 


BY JAIKUMAR VIJAYAN 
HE NEED for tools to 
help IT managers 
assess the effective- 
ness of their security 

investments has fueled anoth- 

er industry effort to develop 
performance measurement 
metrics. 

The latest group to take a 
stab at creating such metrics 
is a new entity called the Se- 
curity Compliance Council. 
The council last week an- 
nounced plans to create stan- 
dard measures to assess and 
benchmark information secu- 
rity performance. 

IT managers said such tools 
can be effective, but they list- 
ed several challenges facing 
the new organization. 

Robert Garigue, chief infor- 
mation security officer at the 
Bank of Montreal in Toronto, 
said the effort’s chances for 
success will depend largely on 
how it builds on existing secu- 


rity frameworks and processes. 


The bank, for example, 
bases a lot of its security proc- 





esses on frameworks such as 
Carnegie Mellon University’s 
Capability Maturity Model 
and the best practices con- 
tained in the Information 
Technology Infrastructure 
Library, he said. 

“Over a period of time, there 
have been a series of processes 
that everyone agrees are good, 
such as patch management, 
antivirus and intrusion-detec- 
tion systems,” Garigue said. 
“What is not available is a way 
to integrate them into a gover- 
nance framework that says, 
‘Here’s a list of the processes 
that need to be implemented, 
and here’s how well you’re do- 
ing with them.’” 

To be successful, the new ef- 
fort must be “additive and not 
just a substitute” to the metrics 
already available, he added. 

The founding members of 
the organization are Houston- 
based security vendor Bind- 
View Corp., the Computer 
Security Institute in San Fran- 
cisco and The Institute of 
Internal Auditors (IIA), a 
100,000-member association 
in Altamonte Springs, Fla. 

The group’s mission is to 
develop research- and survey- 
based IT security guidelines to 


help companies figure out 
what they need to do and how 
they are faring, said David 
Richards, president of the IIA. 

Kim Milford, information 
security manager at the Uni- 
versity of Rochester in New 
York said she welcomes the 
effort but added that its suc- 
cess will depend largely on the 
quality of the information 
used by the group. 

For instance, she pointed 
out, people are reluctant to 
share detailed security infor- 
mation, and there are wide 
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variations in the way compa- 
nies implement and manage 
security technologies and 
measure incidents. Thus it can 
be hard to draw consistent 
data from different organiza- 
tions, she said. 

In addition, adopting some- 
one else’s definition of best 
practices may not always be 
the right solution for a compa- 
ny, said Christofer Hoff, direc- 
tor of enterprise security ser- 
vices at Western Corporate 
Federal Credit Union in San 
Dimas, Calif. 

“Tt may be a cynic’s view, 
but my reality shows that if 
you do what is right for your 
company, which does not 
necessarily mean adopting 
someone’s definition of best 
practices, then regulatory 
compliance may be a natural 
byproduct,” he said. 

The latest effort highlights a 
longstanding challenge in the 
security industry and one that 
several others have tried to 
address before, said Pete Lind- 
strom, an analyst at Spire Se- 
curity LLC in Malvern, Pa. 

“Security ultimately is a 
black-hole exercise where you 
are successful if nothing hap- 
pens,” he said. “The question 
then is whether that was be- 
cause we allocated the right 
set of resources to the prob- 
lem or because there was no 
risk at all in the first place.” 

@ 56591 





Zotob Case May Lead to 
Credit Card Theft Arrests 


BY JAIKUMAR VIJAYAN 

An expanding investigation 
into the recent Zotob worm 
outbreak is producing more 
evidence of a growing nexus 
between worm writers and 
gangs looking to profit from 
cybercrime. 

The FBI last week con- 
firmed that Turkish law en- 
forcement officials are investi- 
gating 16 suspects in connec- 
tion with an alleged credit 
card theft ring that’s possibly 
linked to the Zotob worm and 
its variants. 

The disclosure follows the 
Aug 25. arrests of Farid Esse- 





bar, an 18-year old Moroccan 
who is believed to be responsi- 


| ble for writing the Zotob and 


Mytob worms, and Atilla Ekici, 
a 21-year old Turkish man who 
apparently financed the effort. 


Potential Link 


According to an FBI spokes- 
man, the 16 individuals under 
investigation are not believed 
to have direct links to the cre- 
ation and dissemination of the 
worms that hit several large 
organizations two weeks ago. 
Rather, he said, it’s likely that 
the group is engaged in crimi- 
nal activity that is potentially 





linked to the worms in some 
fashion, he said. The spokes- 
man didn’t provide further 
details. 

The news is further evi- 
dence of a growing alliance 
between hackers and those 
seeking to profit from cyber- 
crime, said Graham Cluley, a 
senior technology consultant 
at antivirus firm Sophos PLC. 
This case serves as solid evi- 
dence of that trend, he said. 

“What you are likely to see 
over the next few days is the 
unraveling of an entire identity- 
fraud gang,” Cluley said. 

According to Cluley, Sophos 
researchers have discovered 
that at least 20 other worms 
and viruses, including multiple 
versions of Zotob and Mytob 
and a version of last year’s pro- 





lific Mydoom worm, were cre- 
ated by Essebar. All the worms 
and viruses include the DiablO 
handle that was used as a code 
name by Essebar, he said. 

The Mytob variants created 
by Diabl0 communicated with 
a server apparently owned by 
a group called the 0x90-team, 
whose Web site discussed 
hacker exploits and credit 
card fraud, another indication 
of the link between worms 
and cybercrime, said Ken 
Dunham, a senior engineer at 
VeriSign iDefense Intelligence 
in Reston, Va. 

The site is registered to an 
individual in Paris and runs 
several online forums on how 
to make money by selling, 
buying and trading stolen in- 
formation, he said. @ 56589 





SDLT 600 Results : 
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In a blind taste test, the SDLT 600 was found to be less than appetizing. Test subjects’ 
comments included, “if there is a hell, this is the food.” Scientists have agreed to conduct 
the next round with condiments. As for data backup abilities, it passed with ease. The 
SDLT 600 has more capacity and more speed than LTO-2 and AIT-3. It also inciudes 
DLTSage™ diagnostic management software and DLT/ice™ archival WORM functionality. 
How do we know? It's been tested. For more info and to see the whitepaper, visit DLTtape.com. 
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india Seeks Stiffer 
Data-Theft Penalties 


BANGALORE, INDIA 
COMMITTEE set up by India’s 

A sisi of Communications and 
© Winformation Technology last 
week recommended that the govern- 
ment adopt tighter provisions and 
stiffer penalties for data theft. The 
committee was formed by ministry 
officials in January to suggest amend- 
ments to the country’s Information 
Technology Act. 

The ministry posted the recommen- 
dations on its Web site and is seeking 
comments and suggestions on the pro- 
posals through Sept. 19. The committee 
is calling for data theft to be listed as 
an offense under the 5-year-old IT Act, 
which currently requires punishment 
only for illegal hacking 
activities. The panel is 
also recommending the 
addition of penalties for 
companies that have been 
negligent in “implement- 
ing and maintaining rea- 
sonable security practices 
and procedures.” 

Business process out- 
sourcing and call center 


companies in India that rR 


handle large volumes of 
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| sensitive data from the U.S. and 
| Europe have been putting pressure 


on the Indian government to pass data- 
protection laws for the past two years. 


| mJOHN RIBEIRO, IDG NEWS SERVICE 


EDS Australia Workers 
Reject Deal, Get Raises 


SYDNEY, AUSTRALIA 


| USTRALIAN EMPLOYEES of out- 
sourcing vendor Electronic Data 


Systems Corp. firmly rejected the 


| company’s latest salary offer, voting 


down a proposed deal that would have 
frozen wage levels but improved some 
worker entitlements. 

After the vote, EDS Australia imme- 
diately implemented a wage increase 
of 3% to 5% and substantially improved 
its parental leave offerings. 

The company also said 
it has contracted with a 
consulting firm to con- 
duct a review of payment 
levels for standby and 
overtime work. 

EDS said the so-called 
People Agreement was 
defeated by a vote of 1,573 
to 1,064. The rejection 
puts the outsourcer in an 
awkward position with 
workers, who are known 


i 





to be largely unhappy about its current 
pay rates. 
“We are disappointed with the 


| results because we believed we had 
| offered substantial improvements to 
| the People Agreement,” said Chris 

| Mitchell, EDS Australia’s managing 
| director. “We understand that our 

| employees have sent us a very clear 


message, and we are responding.” 
m JULIAN BAJKOWSKI, 


| COMPUTERWORLD TODAY (AUSTRALIA) 


| Nokia Opens Sixth 


R&D Center in China 
OKIA CorP. last week opened a 
N research and development center 
in the southwestern Chinese city 
of Chengdu to build applications based 
on third-generation mobile technology. 
The facility is the company’s sixth 
R&D center in China and the second 
to focus on 3G projects. 
Espoo, Finland-based Nokia said it 
expects the new center to help boost 


| its sales in China, although the compa- 


ny also noted that it will develop mo- 
bile applications there for markets 
around the world. 

According to Nokia, 3G services cur- 
rently aren’t available in China. The 
Chinese government hasn't set a date 
for issuing 3G licenses, but observers 
generally expect them to be issued 
within the next year or so. @ 56537 
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Briefly Noted 


Tele2 AB, a pan-European 
telecommunications service pro- 
vider based in Stockholm, has 
started shifting all billing operations 
for its 30 million customers to a fa- 
cility in the Latvian capital of Riga. 
It is also moving some related IT 
support functions there from its 
Uni2 outsourcing subsidiary. 

w JURIS KAZA, IDG NEWS SERVICE 


Singapore Telecommunications 
Ltd. said Lucas Chow, its executive 
vice president of corporate busi- 
ness, will leave SingTel by year’s 
end to take over as CEO of Media 
Corp., a Singapore-based publisher 
and broadcaster. 

mw SUMNER LEMON, IDG NEWS SERVICE 


Infineon Technologies AG, a 
Munich-based maker of semicon- 
ductors, has been awarded a con- 
tract to supply components for 
Microsoft Corp.’s new Xbox 360 
video game console. Infineon said 
that it will supply an advanced se- 
curity chip, a removable solid-state 
memory unit and a single-chip ASIC 
wireless pad controller. 


mw JOHN BLAU, IDG NEWS SERVICE 








Vendor Group Looks for 
Single Voice on Security 


BY JAIKUMAR VIJAYAN 
TechNet, a political advocacy 
group made up of senior execu- 
tives from numerous IT 
vendors, established the 
CEO Cyber Security 
Task Force two years 
ago to promote corpo- 
rate awareness of infor- 
mation security issues 
and influence govern- 
ment policymaking. 

In July, TechNet 
named Chris Zannetos, CEO 
of Framingham, Mass.-based 
Courion Corp., as a co-chair- 
man of the task force. Zannetos 
spoke with Computerworld 
last month about his plans to 
seek broader support for the 
group’s efforts. 


ties for the cybersecurity task 
force? One is to take the secu- 
rity evaluation for 
CEOs that we have de- 
veloped and work 
across industry to mod- 
ify it, integrate it and 
combine it with others 
so that we can have a 
more consistent and a 
more coordinated 
voice. The second area 
is around the Common Crite- 
ria [security certification for 
selling IT products to the 
government]. We believe that 
there is a lot of confusion 
about the Common Criteria 
and that there may be some 
unintended consequences of 


| What are your immediate priori- 








the Common Criteria as they 
currently exist. 


Where are you hoping to get 
broader support for your efforts? 
We would certainly look at 
vertical organizations. Securi- 
ty, for instance, is a very im- 
portant topic in health care; 
certainly privacy is. 


TechNet is a vendor organization. 
Will that hamper your ability to 
work with other groups that may 
see you as being biased? The 
good news is we have very 
broad involvement across ven- 
dors on the Cyber Security 
Task Force. What that leads 
our customers to believe, 
maybe, is that some of that 
vendor bias will be washed 
out because there’s not one 
vendor who’s driving this, or 
two or three. But we are in 
fact sensitive [to the issue], 





which is why we’ve been 
reaching out to other organi- 
zations, including those that 
aren’t vendor-based. We’ve 
had very preliminary discus- 
sions with a number of cus- 
tomer-only organizations to 
combine our efforts, or at least 
coordinate our efforts. 


What exactly are some of the 
problems with the Common 
Criteria? It takes an organiza- 
tion roughly six to 12 months 
to be certified at a cost be- 
tween a quarter-million dol- 
lars and a half-million dollars. 
For many companies, [that] is 
not a big deal. But a great deal 
of the innovation is coming 
from smaller organizations, 
and a quarter-million to a half- 
million is a very expensive 
cost for them. 

So the question then arises, 
Will these small companies go 





through certification and have 
a higher cost structure, and 
will they survive if they do? 
And if they don’t go through 
certification, will the U.S. gov- 
ernment get the most innova- 
tive information security tech- 
nologies? 


Are you concerned about more 
government mandates in the wake 
of recent security breaches? 
There are many, many efforts 
within Congress to try and ad- 
dress a variety of different 
things, whether it’s potentially 
creating an IT version of Sar- 
banes-Oxley or whether it’s 
[requiring] database encryp- 
tion. But their expertise is in 
governing and creating effec- 
tive laws and not in informa- 
tion security, which is why we 
think it’s vital to have a vi- 
brant cybersecurity task force 
within TechNet. @ 56454 
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NEWS 


King County Ready 
‘To Restart ERP Effort 


Hopes to learn from earlier failed tempt 





BY MARC L. SONGINI 
FTER SPENDING 
$39 million on an 
ERP system that 
failed to meet man- 
agement’s goals for the proj- 
ect, King County in Washing- 
ton would like to have another 
crack at succeeding. 

Officials blamed a lack of 
management oversight for 
the failure of the ERP system, 
which included PeopleSoft 
human resources software and 
SAP AG’s R/3 financial appli- 
cation. That implementation 
was frozen in 2000, three 
years after it started. 

The new Accountable Busi- 
ness Transformation Program 
(ABT) calls for rolling out 
current versions of Oracle 
Corp.’s financials and People- 
Soft human resources soft- 
ware to about 15,000 county 
employees by 2009. The proj- 
ect is still before the King 
County Council’s Budget 





and Fiscal Management Com- 
mittee, which postponed dis- 
cussion of the new plan last 
week. 

The new system aims to en- 


| able departments to employ 


best practices for financial, 
budget and human resources 


processes, county officials said. 


The ABT team, made up of 
in-house staff and indepen- 


| dent consultants working un- 
| der County Executive Ron 
| 


Sims, needs $2.4 million in 
funding for preplanning work, 
including a business design 


| and cost analysis. That outlay 


requires a vote from the coun- 
ty council. 

An independent consultant 
hired by the county, Dye Man- 
agement Group Inc., estimates 
that the cost of implementing 
ABT will run about $47.5 mil- 
lion. That figure will be re- 
examined next year. 

“Our proposal is to imple- 
ment in 2007 and finish in 


2009, and if possible, we'd like 
to stay on schedule,” said Car- 
oline Whalen, deputy county 
administrative officer. “We're 
currently delayed, and we 
don’t have the funding to com- 
plete the next phase of work.” 

The ERP saga in Seattle- 
based King County is a long 
one. Deadlines slipped in the 
initial rollout, and by the time 
the project was halted, the 
PeopleSoft application was in- 
stalled for 5,000 workers but 

/3 hadn’t been installed on 
any systems. The county had 
spent $39 million by that 
point, officials said. 


Expertise Required 
A key problem holding up 
approval of the new system, 
at least for council member 
David Irons, is the lack of 
what he called a tech-savvy 
person to oversee the imple- 
mentation. 

“T’ve told [the ABT team] to 
not come back until they have 
| a manager with the technical 





IBM to Add Software for Managing SOAs 


BY MATT HAMBLEN 

IBM this month plans to an- 
nounce software for managing 
service-oriented architectures, 
making it the latest in a line 

of vendors offering tools for 
automating the process of 
monitoring SOAs and the ap- 
plications that run on them. 

The software, called IBM 
Tivoli Composite Application 
Management (ITCAM) for 
SOA 6.0, will monitor applica- 
tion performance and give 
network managers views of 
application servers and the 
other SOA infrastructure com- 
ponents, according to docu- 
ments IBM presented at the 
Share user group conference 
in Boston two weeks ago. 

SOA management software 
has been available from start- 
ups for more than two years, 
but it’s now becoming a prior- 





ity for large vendors of man- 
agement tools and application 
server software. Hewlett- 
Packard Co. and BEA Systems 
Inc. both announced products 


NEW SOFTWARE 


in June, and vendors such as 
BMC Software Inc., Computer 
Associates International Inc. 
and Oracle Corp. also compete 
in the SOA tools market. 


tions architect at Providence 
Health System in Tigard, Ore., 
said he’s happy with the Web 
services management tools 
from Infravio Inc. that he has 
used for the past three years. 
The Infravio tools work with 
components of BMC’s Patrol 
management suite. But Sar- 
gent said he still needs more 
from his management tools. 
“Td ultimately like to see a 
visualization and management 
tool for Web services that un- 
derstands where they are run- 
ning and how well they are 
running, and their interac- 
tions,” he said. “As an applica- 
tion developer, I want to make 





Erik Sargent, a Web applica- | 
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The Downfall of an ERP System 


THE KING COUNTY Council is 
approaching its latest ERP proj- 
ect cautiously with good reason. 

“We got terribly burned once 
before, and we found there’s a 
need to take extra time on this 
new expenditure,” said Larry 
Phillips, chairman of the council. 

The original ERP rollout that 
began in 1997 involved installing 
PeopleSoft and SAP software 
and it never fully delivered the 
expected results. 

A key issue, said Phillips, was 
a lack of personnel experienced 
in implementing ERP systems. 
“They hired great people; they 
were good managers in other 
fields, but they had never oper- 
ated in this one, and it can be 


background to implement the 
system,” he said. “I don’t be- 
lieve in giving them a blank 
check. We spent $40 million 
and ended up with virtually 
nothing out of it.” 

Irons said he believes the 
upgrade is mission-critical 


| and probably should have 


been done 10 years ago to get 
more-detailed financial infor- 
mation to county officials. 


sure the apps are running and, 
if not, that the server and net- 
work guys can respond.” 
Shawn Willett, an analyst at 
Current Analysis Inc. in Ster- 
ling, Va., hasn’t received a 
formal briefing from IBM on 
ITCAM but has reviewed the 
Share presentation. Willett 
said IBM appears to be cover- 
ing its bases so it can compete 
against its top software rivals 
for SOA-related business. 
IBM’s offering “looks like it is 
heavily weighted toward man- 
agement, monitoring and en- 
forcing of policies rather than 
setting up any kind of infra- 
structure for SOAs,” he noted. 
ITCAM will support SOAs 


| based on IBM’s own Web- 


Sphere software or BEA’s rival 
WebLogic application server, 
plus SOAs developed using 
Microsoft Corp.’s .Net tech- 
nology, according to IBM. It 
declined to disclose pricing or 
a shipment date. @ 56583 





complex,” he said. 

The new ABT system will 
show more conformity and less 
customization, which will help 
keep costs down, Phillips said. 

A county-commissioned re- 
port on the first project, issued 
in June 2001 by Dye Manage- 
ment Group and IBM Global 
Services, noted a number of 
organizational barriers to suc- 
cess. Those included the lack of 
“a well-conceived, structured, 
comprehensive business 
change-management process 
reinforced by a visible and ac- 
tive senior-level commitment” 
and “independent outside over- 
sight on the executive side.” 

- Mare L. Songini 


“But at the same time, we have 
to bring some accountability 
to the [implementation] proc- 
ess,” Irons said. 

Whalen said the county plans 
to hire an ABT project manag- 
er by the middle of the month. 
Once that manager is in place 
and addresses any council con- 
cerns, Whalen hopes that ABT 
can get the necessary funding 
and proceed. 

Irons said that he is also 
worried that the length of the 
rollout will leave the county 
with outdated software. The 
proposed system also requires 
an interface between Oracle 
and PeopleSoft. 

“My background tells me to 
minimize the points of fail- 
ure,” he said. “We're adding 
critical points of failure.” 

Whalen explained that King 
County will standardize on 
Oracle rather than SAP be- 
cause the former has been in- 
stalled on one-third of the 
county’s systems for an unre- 
lated project. SAP’s R/3, on 
the other hand, wasn’t in- 
stalled on any systems prior 
to the cessation of the original 
project, she said. 

For its part, SAP is calling 
on the county to take another 
look at its solution. “We’d en- 
courage the county to consid- 
er all their options,” said an 
SAP spokesman. “The initial 
SAP project never got out of 
the gate.” @ 56582 
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NSF Proposes Ambitious Internet Project | 


BY GRANT GROSS 
WASHINGTON 


| proposal “very, very prelimi- 
nary. As I understand it, this 
The National Science Founda- | could be years in the making.” 
tion (NSF) has proposed a The NSF's Directorate for 
plan for creating a next-gener- = 

ation Internet with built-in 
security and functionality that 
connects all kinds of devices. 

The agency’s Global Envi- 
ronment for Networking In- 
vestigations (GEND) initiative 
would include a research 
grant program and an exper- 
imental facility to test new 
Internet technologies. The 
project isn’t yet funded, said 
Richard Vines, an NSF spokes- 
man. “It’s an idea under con- 
sideration,” he said. 

Researchers need to explore 
radical new ideas for address- 
ing continuing challenges such 
as Internet security and ease 
of use, said David Clark, a se- 
nior research scientist at MIT’s 
Computer Science and Artifi- 
cial Intelligence Laboratory. 

“T’m not at all picking on the 
Internet — the Internet does 
what it does well,” said Clark, 
who received a grant to advise 
the NSF on the GENI project. 
“But there are some things 
where you say, ‘That doesn’t 
work right.” 

NSF officials announced the 
GENI project last month at a 
conference for the Special In- 
terest Group on Data Commu- 
nications in Philadelphia. 


Computer and Information 
Science and Engineering is en- 
couraging the involvement of 
other government agencies, 


Beyond Gradual Change 
Clark said the GENI project 
aims to go beyond current ef- 
forts to incrementally improve 
the Internet. For example, the 
U.S. Department of Defense 
has been pushing for adoption 
of Internet Protocol Version 6 
to replace the widely used 
IPv4. The GENI project would 
go years beyond that, said 
Clark, who was chief protocol 
architect for the government’s 
Internet development efforts 
during the 1980s. 

Clark hopes that the GENI 
project will envision Internet 
needs that are 15 years away or 
more. “I’m worried about the 
framing of the question so that 
we don’t think so incremental- 
ly,” he said. 

Vines last week called the 


= 





private companies and other 
nations, according to a GENI 
page on the NSF Web site. 
The goals of the GENI ini- 
tiative include new core Inter- 


net functionality, such as nam- | 
| ing, addressing and identity 


architectures; enhanced secu- 


| rity and high availability; and 
| new Internet services and ap- 


plications. @ 56543 


Gross is a reporter for the 
IDG News Service. 
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OPINION 


DON TENNANT 


Has HP Forgottenr 


COULDN'T have been the only one who was 
stunned last Monday when Hewlett-Packard 
said it didn’t yet know whether its HP Tech- 
nology Forum, slated to be held in New Or- 
leans two weeks later, would need to be post- 
poned. That decision, HP said, would be made by 


the end of the week. 


It was kind of surreal to 
read that on the confer- 
ence Web site while tog- 
gling to various news 
sites to read about and 
view the devastation of 
New Orleans. “Are they 
kidding?” I asked myself. 
“The place is a wreck! 
There’s absolutely no 
way they can go ahead 
with the conference. Why 
can’t they see that?” 

A bit of light was shed 
on the matter when someone for- 
warded me an e-mail that the HP 
Technology Forum team sent to reg- 
istered attendees last Monday after- 
noon. The e-mail stated that HP was 
monitoring the situation closely and 
that a decision on the “direction” of 
the conference would be made on or 
before Sept. 2. Then came the kicker: 
“Please be cognizant that the media 
coverage of an event of this magni- 
tude can be sensationalized for ef- 
fect. While some areas have with- 
stood damage, others may have not.” 

Now, I have no problem with a 
healthy skepticism of media reports. 
We in the media have goofed up fre- 
quently enough to have brought that 
on ourselves. But I do have a prob- 
lem with HP sending out a sweeping 
accusatory message under these cir- 
cumstances. I have no idea how a 
journalist would even begin to go 
about sensationalizing this story. No- 
body has been making this stuff up. 
We've seen the devastation with our 
own eyes, and we’ve heard vivid 
firsthand accounts of the enormity 
of the hurricane’s impact. Why triv- 
ialize all that with a suggestion of 
media sensationalism? 





When I asked HP why it 
felt it necessary to convey 
an accusatory message 
like that, Don Gentile, an 
HP PR director, e-mailed 
me an explanation. 

He said the message I 
have quoted above “was 
generated quickly by the 
HP Americas events team 
just as the hurricane’s ini- 
tial impact on the Gulf 
Coast was being covered. 
They subsequently ex- 

plained to us (in PR) that at that time 


| they didn’t want attendees to hastily 


cancel their plans based solely on 
media images — we all remained 
‘cautiously optimistic’ that New Or- 
leans had been spared the worst of it. 
Other areas were showing signs of 
severe damage and it would be un- 
derstandably easy to confuse loca- 
tions. When the levee situation de- 





graded within the city, they immedi- 
ately changed the message on the 
Web site and of course they sent out 
a second e-mail message postponing 
the event shortly thereafter.” 

OK, but I still question the indeci- 
siveness — there simply was no need 
to leave hundreds of users in limbo, 
even for a day. And it’s irresponsible 
to couch the indecision in distrust of 
the media. I can’t think of any other 
vendor that would have taken that 
tack. But then again, I can’t think of 
any other vendor that has such an 
awkward relationship with its users. 

As we approach the four-year an- 
niversary of the Sept. Il terrorist at- 
tacks, I can’t help but flash back to 
the events of that horrendous day. 
No one accused the media of sensa- 
tionalizing that story. Perhaps that’s 
because there was no paralysis to ex 
plain. Tough decisions — yes, even 
decisions as relatively inconsequen- 
tial as canceling IT conferences — 
were made boldly, promptly and 
with no excuses. 

Consider that one more very good 
reason to never forget that day. 

@ 56550 
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Giving IT 
Messages the 
Smell Test 


HE QUALITY of com- 
munication is in de- 
cline, and nowhere is 


this more evident than in IT. 

With this as a premise, researchers at 
the IT Leadership Academy created a 
five-part framework to help you ana- 

lyze the “stories” of IT. 

Content. What is the IT story in your 
organization? Is it full of fresh ideas? Is 
there a story at all? Pentagon planners 
have interpreted the lack of importance 
that science, technology and computing 
have for many Americans as a potential 
threat to national security. So they have 
commissioned the American Film Insti- 
tute to convene a group of midcareer 
researchers, engineers, chemists and 
physicists and ground them in the art 
of storytelling — story arcs, plot 
points, pitching, get- 
ting buy-in — so that 
they can bring the 
point home to more 
USS. citizens. Similar- 
ly, the future of tech- 
nology is linked to 
the presence of great 
technology stories 
and storytellers. 

Clarity. Read a ven- 
dor brochure, take a 
sales call or read a bit 
of technical docu- 
mentation, and you 
will see that clarity 
is an issue. Jargon usage among IT ven- 
dors and analysts exceeds that of any 
other discipline. Shipments of import- 
ed shrimp undergo “organoleptic 
analysis” — that means it’s smelled to 
make sure it’s fresh. You should “smell” 
the messages emanating from your IT 
shop to make sure they don’t stink. 

Consumability/showmanship. The big 
issue facing IT practitioners is the 
need to frame their messages and 
know their audiences. (For vendors, 
the big issues are clarity and correct- 
ness.) It’s rare to find an IT organiza- 
tion with the right narrative, an effec- 
tive story line or powerful metaphors. 

Zookeepers in need of funding to 
take care of their animals know that 
they need to put on a show. Thus, most 
U.S. zoos put papier-maché “prey” 
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stuffed with meat in predators’ cages. 
Carnivores attack the fake prey, rip 
them apart and feast on the food with- 
in. It entertains the zoo visitors. 

We need to make infrastructure and 


as = . 
security interesting. The tools of story- 


telling include captivating an audience 
via perspective. People are curious to 
see familiar places from a dramatic 
perspective. When we succeed at do- 
ing that, the story will be retold. We 
need to understand the processes by 
which ideas spread. 

Control/spin. NASCAR is frustrated 
that it doesn’t get the kind of general 
news coverage it feels it deserves. 
NASCAR is the second-highest-rated 
regular-season sport on TV, according 
to Nielsen Media Research. But you 
wouldn’t know that by watching the 
Sunday-night sports highlights or read- 
ing the morning paper. In the absence 
of someone else telling your story, you 
need to take charge. NASCAR is creat- 
ing a division to generate news for 
newspapers, radio, TV stations and ca- 
ble networks to mix into their content. 

You need to take charge of the mes- 
sage — its creation and its placement. 
This is what the German government 
recently did. It hired a public relations 


firm to put out a book crediting many of 


the world’s greatest inventions to Ger- 
mans. The book, German Stars: 50 Inno- 
vations Everyone Should Know About, is 
an example of managing a message. 
Correctness/believability/accuracy. When 
assembling your message, be careful of 
being too Madison Avenue. Your mes- 
sage has to be believable, accurate and 
correct. At a storytelling workshop, one 
of the seasoned and successful story- 
tellers suggested, “Tell your story for 
you. Then go back and rewrite it for 
the audience you wish to influence.” 
Among the skills future technolo- 
gists will have to master, storytelling 
ranks near the top. Contemporary IT 
leaders need to understand the story- 
telling processes at work in their 


world. @ 56468 


JOHN D. HALAMKA 


My Wired 
World 


’M OFTEN asked how I 

maintain several jobs — 

CIO at Harvard Medical 
School, CIO at Beth Israel 


Deaconess Medical Center, CEO of 
MA-Share, emergency physician and 
father. The answer is simple: highly ef- 





| since 2 a.m. Overnight, 
| major server upgrades, se- 


| enhancements. 


ficient use of technology. 
Here’s a typical day: 

At 5 a.m., I open my eyes 
and glance at my Black- 
Berry 7290 GSM/GPRS 
Bluetooth phone/e-mail de- 
vice and read through the 
50 e-mails I have received 


gested a mushroom, and 
the emergency department 
is requesting a consulta- 
tion. I recommend that 
they take a picture with a 
cellular phone and send it 
to my BlackBerry. 

A few minutes later, I ar- 
rive at the site of my first 
meeting and place a Jabra 
250 Bluetooth headset on 
my ear. While walking, the 
picture of the mushroom 
arrives, and I recognize it 
as a harmless Marasmius. I 
click on my BlackBerry and 
finish the consultation via 
hands-free Bluetooth head- 
set. Then I sit down to my 
first meeting. 


gency department, I pass a scanner near 
| my arm. An RFID device, implanted un- 
| der the skin of my right arm between 
| elbow and shoulder, emits my medical 
| record number and enables a secure 
| Web-based application to display my 
| entire medical history. All 57,000 square 
| feet of the emergency department are 
wirelessly enabled for data, voice over 
IP and geolocation via active RFID 
| tracking tags. I clip a PanGo Networks 
tag to my belt, and a dashboard shows 
| my physical location as I walk through 
| the department, enabling clinicians and 
patients to rapidly find me. 
On to my next meeting, at Harvard 
| Medical School, where my laptop re- 
orients itself. While there, I automati- 
cally create a copy of my bio-sketch for 
| a grant, via an automated application 
I open my IBM X41 lap-__| that pulls all my publications from the 
top, which automatically | National Library of Medicine. 
recognizes that 1am at Beth | I have Bluetooth, GSM/GPRS and 
Israel Deaconess Medical | RFiD on my body 24/7. Admittedly, 
Center and logs me onto the EAP-Fast | when I travel in remote areas to rock- 
| 


there are generally a few ‘ae is ClO 
F at CareGroup Health 
curity patches and network System, ClO and asso- 
By 6 a.m., I’m out the 
door, heading for my 2005 
Prius. It has no ignition key 
but senses the approach of 
my Bluetooth signal and un- 
locks the door as I touch the 
handle. I sit down and press 
the power button. The car 
starts and announces that it 
has successfully connected 
to my BlackBerry so that all 
calls can be handled via the Prius au- 
dio system. 
I have meetings in five locations, so I 


secured network; it even knows my and ice-climb, I am challenged by lack 
| 
type the addresses into the Prius, and | 
| 


printer preference for this location. of signal, so I carry a wide-area text 

I run the meeting and take down the | pager as backup. Luckily, I can connect 
minutes on my wireless laptop. As we on most summits. This article was 
adjourn, I e-mail the minutes and ac- composed and sent from the top of 
tion items to all of the attendees, then Grand Teton, at 13,770 feet. @ 56481 


walk to my next meeting, answering 30 — — 
WANT OUR OPINION? 


e-mails on the way. 
: eeting a g f re {Ts to 
I'm meeting a group of reporters t More columnists and links to archives of previous 
columns are on our Web site 


discuss the use of radio frequency iden- 
www.computerworld.com/columns 


it calculates the optimal path. I want to 
stop for tea, so I ask the Prius’ voice- 
recognition system to identify all cof- 
feehouses along the route. 

My first phone call is picked up by 
the Prius, which automatically mutes 
the CD I’m playing and pipes the call 
over the audio system. A child has in- 





tification in health care. In the emer- 


ats 


Another Example of HP’s Betrayal of Users 


FEEL | must disagree with Don 

Tennant's statement, “But no one 
can argue that it was HP that pulled 
the rug out from under Interex’s 
members last week. The Interex 
leadership did that itself” [“Never 
Mind,” QuickLink 55704]. | must be 
“no one.” 

Let me explain. Interex has been 
holding its conference in August for 
as lona as | can remember (I have 
been using an HP 3000 since 
1979). Why did HP, which has never 
held such a conference, pick Sep- 
tember for its inaugural confer- 
ence? | don't believe for a minute 
that was not a calculated move. If 


HP did not want to hurt Interex, why | 


not pick a spring date? This, along 
with HP dropping active support for 
the conference by lowering its floor 
space from 7,000 square feet to 
900 and reducing its sessions from 
400 to 38, certainly took a toll. 

Itis unfortunate that HP con- 





tributed to killing an independent 


| organization that provided an un- 


biased view of HP for tens of thou- 


| sands of HP users. It was also un- 


fortunate when Carly Fiorina killed 
the HP e3000 in order to force its 
users to switch to the HP-UX for- 
mat, but that is another story. 


| James Ouellette 


Vice president of IT, 


| Rocky Hill, Conn., 


JimOuellette@hotmail.com 


OBJECT to the notion that “no one 
can argue that HP pulled the rug 


| out from under Interex’s members.” 


| am a former customer of 
Hewlett-Packard, and | believe that 
HP has declared war on its cus- 
tomer base. | was at the HP World 
2001 conference when Winston 
Prather stood up in front of a room 
full of HP e3000 users and stated 
that the 3000 was an integral part 
of HP’s plan and vision for the fu- 





ture. Less than three months later, 
HP announced that the platform 
would be discontinued. One could 
argue that this was unfortunate tim- 


ing, but in January of 2002, Aivina 


Nishimoto of HP let slip that the de- 
cision to kill the 3000 had already 
been made at the time of HP World, 
but it was decided by HP’s manage- 
ment that the conference wouldn't 


be the proper place to announce the | 


death of the platform that made HP 
a player in the computer world. 

This was the first time in my 25 
years of association with HP that 
someone from the company had 
ever lied to me. After that 2001 con- 
ference, the Fiorina-led HP com- 
pletely obliterated its impeccable 
reputation and become a purveyor 
of commodity equipment with high 
prices and no redeeming value 

| have completely divested my- 


self of every piece of HP equipment | 


that | owned, and | refuse to buy 
anything with either a Compaq or 
HP label. The upshot of all of this is 





| that HP is no longer a company you 


can trust. This latest back-stabbing 


| action by HP against its users is just 


the latest in a series of moves calcu- 
lated to reposition HP from a leader- 


| ship position in high-value systems 
| toa purveyor of “me too” PC clones. 
| Why anyone would place any confi- 


dence in this company going for- 
ward is a complete mystery to me. 
Richard J. Bober Jr. 


Willington, Conn. 


| COMPUTERWORLD welcomes 
| comments from its readers. Letters 
| will be edited for brevity and clarity. 


They should be addressed to 
Jamie Eckle, letters editor, Com- 
puterworld, PO Box 9171, 1 Speen 


| Street, Framingham, Mass. 01701. 
| Fax: (508) 879-4843. E-mail: 


letters@computerworld.com. 
Include an address and phone 
number for immediate verification. 


For more letters on these and 
other topics, go to 
www.computerworld.com/letters 
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“At Nissan, we expect to save at least $135 million annually 
thanks to the efficiencies that Windows Server 2003 and 
Exchange Server 2003 are helping us achieve.” 


Toshihiko Suda 
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An upgrade to Microsoft Windows Server System 
made it possible for 50,000 worldwide employees 
at Nissan Motor Company to have more secure 
remote access to their e-mail and calendars 
from any Internet connection, without the hassle 
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Windows Server 2003 and Exchange 2003, not only 
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collaboration, they expect to save at least $135 million 
by streamlining their messaging infrastructure. 
To get the full Nissan story or find a Microsoft 
Certified Partner, go to microsoft.com/wssystem 
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IT Gives Airlines a Lift 
IT projects in the areas of 
customer service and mainte- 
nance automation have paid 
dividends for cash-strapped 
airlines. Page 26 


Here’s how IT 
professionals say 
they’ve pulled off 
major network 
upgrades without 
disrupting users. 
By Drew Robb 


PGRADING a network is 
never easy, especially 
when the work must be 
completed without inter- 
rupting service. Hal Mc- 
Gregor, network manager 
at Beth Israel Deaconess 
Medical Center faced that challenge 
after the Boston-based hospital’s net- 
work failed. 

“We experienced a major network 
outage in 2002 involving Layer 2 
switched topology that depended heav- 
ily on spanning tree for redundancy,” 
he says. The problem was that the net- 


work hardware was at the end of its life, | 


having been kept in service too long be- 
cause of capital spending constraints. 
McGregor’s team manages the net- 
work for Beth Israel Deaconess and 
other area hospitals, clinics and offices 
— that’s 17,500 active ports on over 300 





| 
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FUTURE WATCH 

Molecular 

Self-Assembly 

Nanoscale circuits have the 
ability to build themselves, 
promising to keep Moore’s Law 
alive for many years. Page 28 


0905.05 


SECURITY MANAGER'S JOURNAL 
Starting Over, With 

Intrusion Detection 

Mathias Thurman finds lots to keep 
him busy at his new job, but budget 
considerations put intrusion detection 
at the top of the list. Page 30 





routers and switches linking users at 
125 locations. And the task of upgrad- 
ing the system needed to be done 
without downtime. 

“Because of our need for uptime for 
patient care, we did it with minimal 
disruption — the network upgrade was 
like changing the wings on a 747 while 
it’s flying,” says CIO John Halamka, 
who’s a Computerworld columnist. 

The hospital did it by first building 
and testing a parallel network. The 
project required three months for 
planning, six months for building the 
network core and distribution layers 
and 15 months for installing the access 
layer. 

Taking a measured, orderly ap- 
proach was key. “Don’t rush and short- 
change the planning phase,” McGregor 
advises, “and be sure to allow ample 
project time.” 


Gigahertz and Gigabits 


Successfully upgrading a network re- 
quires first defining what you want to 
get out of the change. The answer may 
not always be as simple as raising 
bandwidth another notch. 

“Rarely do I run into someone with- 
out enough bandwidth,” says Michael 
Herald, a senior consultant at Compu- 
Com Systems Inc., an IT services firm 
in Dallas. 

Users always want more speed, but 
extra bandwidth doesn’t necessarily 
make a difference. Moving to voice 
over IP is one example. 

“They will get a jittery voice and 
decide to upgrade the bandwidth, 





but that doesn’t help,” Herald says. 
“The bandwidth may be only 3% uti- 
lized, [but] they need better quality 
of service.” 

For Jim Kirby, a network architect at 


| Wells Dairy Inc. in Le Mars, Iowa, the 


defining issue was system reliability. 
The company, which sells ice cream 


| and yogurt in 28 countries under the 
| Blue Bunny and Weight Watchers 


brands, among others, had a LAN con- 


| necting its warehouses, ice cream 
| plants, offices and data centers around 


the town, as well as a WAN linking 


| headquarters to plants in two other 


Continued on page 24 
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Continued from page 21 


states. The architecture was inadequate. 


“We had a number of end-to-end 
[virtual] LANs across the campus, but 
we had outgrown that model,” he says. 
‘This resulted in instability, which im- 
pacted production with downtime.” 

Kirby replaced the system with a 
three-tier, routed and switched archi- 
tecture that consisted of core, distribu- 
tion and access layers and was broken 
into multiple zones. It has a Gigabit 
Ethernet fiber backbone and 10OMbit/ 
sec. connections to users. 

“Because we operate manufacturing 
24 hours a day, we took every high- 
availability option we can get,” he says. 
“If anything goes down, at least we will 
be able to maintain a connection be- 
tween the data center and the plants.” 


Careful Planning 

The switch took six months. The new 
equipment was staged and extensively 
tested before deployment. Cables were 
labeled, and the infrastructure group 
installed the equipment throughout 
the campus. With everything in place, 
the networking team spent a weekend 
plugging in the cables, configuring the 
ports and changing IP addresses. 

“We had planned everything very 
meticulously,” says Kirby. “On Monday 
morning, there were a couple IP ad- 
dress conflicts we had to resolve, but 
by and large it was a very smooth 
start-up.” 

Cutting costs can also be a motiva- 
tion for upgrading a network, says 
Gartner Inc. analyst David Willis. For 
example, consolidating an ERP applica- 
tion onto a centralized server can cut 
support costs, but it requires a reliable 
connection to any branch office that 
used to host the application locally. 

Willis also stresses the savings that 
come from simplifying administration 
and the benefits of hardware conver- 
gence that reduces the number of de- 
vices you need to support. 

“Boxes now tend to be multifunc- 
tional,” he says. “There is a huge differ- 
ence in processing power and capabili- 
ties between the Cisco 2500 branch- 
office router and the 2800 unit, which 
includes an integrated firewall, better 
security and VPN termination.” 

Willis says that although bandwidth 
needs are growing fast, most organiza- 
tions have more than enough. He says 
companies are upgrading with Gigabit 
Ethernet because it isn’t much more 
expensive than 1OOMbit Ethernet. 

But for WAN connections, which re- 
quire paying a carrier for the additional 
bandwidth, he recommends exploring 
ways to cut down on the traffic load. 


| ditional capacity from the carrier. 





“There is a whole class of equipment 
we call WAN optimization controllers 
that reduces bandwidth consumption 
and boosts performance,” says Willis. 


| “By applying quality of service, traffic 


management, compression and cach- 
ing, you can reduce the need to buy ad- 


| Avoiding Disruption 


The key to any successful network up- 
grade is pulling it off without disrupt- 


ing users. It’s not always easy, but it can | 


be done, network professionals say. 

“It comes down to three things: 
planning, communication with users 
and really understanding the data 
flows,” says Brett Rushton, vice presi- 
dent for strategic services at Calence 
Inc., a network design and manage- 
ment firm in Tempe, Ariz. The plan- 
ning starts with finding out what’s in 
place — both physically and logically 
— and how it’s performing. Frequently, 
existing diagrams are incomplete or 
inaccurate, if they exist at all. 

“Often, you will find departmental 
servers sitting under someone’s desk 
that you haven’t taken into account,” 
says Rushton. “The number of times 
you find cabling plans with nothing la- 
beled at each end would astound you.” 

Before going live with the new 
equipment, you must thoroughly test 
connectivity as well as any critical 
applications that will be running over 
the network — particularly where the 
upgrade involves changing addressing 
schemes. 

This ties back to the priority of com- 
munication — finding out exactly what 
applications users depend on and co- 
ordinating with the different business 
units along the way to ensure a smooth 
transition. 

Rushton cites a campus network up- 
grade for a Fortune 100 financial ser- 
vices firm where communication 
broke down. When the users cut over 
to the new network, many couldn’t ac- 
cess a key credit-approval application. 

“The users hadn’t told us this was 
one of the critical applications they 
were using, so it didn’t come through 
in the testing procedures,” recalls 
Rushton. 

Fortunately, Calence was able to 
locate the bug and re-establish service 
without having to roll back the changes. 
But this emphasizes an important 
point, Rushton says. IT departments 
should build the network and repeat- 
edly test it before any deployment, but 
they also shouldn’t assume that the 
tests accurately reflect reality. He rec- 
ommends doing a phased rollout of the 
network and applying the lessons 


r 


| 
| 


HE PAI 


Verify that the latency is coming 
from the network, not some 
other part of the system, before 


idding bandw idth. 


Build and test the network in 
the lab before installing it. 


Do a phased rollout when possi 
ble, so changes can be easily 


rolled back ifnecessary. 


Pian for the next five years’ 
requirements, not just what 


is needed now. 


Consider security, content 
caching, power over Ethernet 
and quality of service as well as 
increasing bandwidth. 


Build a modular network that can 
be easily reconfigured to meet 
changing needs. 


\fter that weekend upgrade, 
be ready Monday morning to 
quickly address any bugs or even 
perform a complete rollback if 


hecessary. 


learned in the beginning to other user 
groups later in the process. 

Golden Gate University took this 
approach when switching to an Ether- 
| net service provider for connections 
among its seven campuses on the West 
Coast. 

After initial testing in San Francisco, 
the school selected one regional site 
as a pilot. Subsequent installations at 
the other campuses were performed 
during scheduled downtimes in the 
evening and on weekends. 

Golden Gate followed the systems 
development life-cycle project man- 
agement model. 

“Practically speaking, this means 
building out at least one copy of any 
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new infrastructure in a development/ 
preproduction laboratory environ- 
ment, as well as building out the pro- 
duction infrastructure in parallel to the 
pre-existing resource that is to be re- 
placed,” says IT operations manager 
Karl Ehr. “This maximizes the chances 
for discovering unforeseen issues as 
soon as possible and provides a valid 
back-out plan should the need arise.” 


Stay Flexible 


Correct planning is indispensable and 
should include a five-year horizon. 
That means building some flexibility 
into the network. 

Al Hofmann, director of enterprise 
networks at Hartford Hospital in Con- 
necticut, oversees an 11,000-node net- 
work serving a 45-building main cam- 
pus and nearly 100 remote facilities. 
He started an upgrade project by cre- 
ating a long-term plan that defined the 
architecture and specified the vendors. 
He then rolled it out over a period of 
four years. 

The design was flexible enough that 
Hofmann’s IT staffers could incorpo- 
rate newer technologies without vio- 
lating the overall plan. For example, 
they started out using Category 5 
cables but then switched to Cat 6 and 
Cat 6e over time. 

“As new technology became avail- 
able, we took advantage of it,” explains 
Hofmann. “We had already established 
a standard for wiring and labels and 
patch panels, which made changes and 
progressive updates much easier as 
new equipment came in.” 

The architecture — a fully redun- 
dant, three-tier network — also makes 
it easy to upgrade service without in- 
terruption. 

“If we are doing a speed change and 
don’t want to interrupt the user, we 
can move that traffic onto a secondary 
path while we upgrade the primary,” 
says Hofmann. He stresses the impor- 
tance of starting out with a coherent 
plan. But don’t get overconfident, he 
cautions, even if everything tests out 
perfectly in the lab. 

“Even with the best planning in the 
world, you will still have small issues, 
and you need to be prepared to re- 
spond to those things at the first go- 
live date,” says Rushton. “Monday 
morning 8 a.m., you need to have the 
SWAT team in place to address any 
customer issues on connectivity or 
perception issues around perfor- 


mance.” @ 56350 





Robb is a Computerworld contributing 
writer in Los Angeles. He can be reached 
at drewrobb@sbcglobal.net. 
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Airlines 


Automation initiatives in 
customer service and 
maintenance operations 


" . . The US. airline industry is in a financial tailspin. Increased 
are increasing efficiency 7 


security concerns since the terrorist attacks of Sept. 11, 2001 


. a. /\ rising fuel costs and depressed fares have all taken their toll. 
and cutting costs at the ie 


US Airways Group Inc. and United Air Lines Inc. are in 


major carriers. . bankruptcy. Delta Air Lines Inc. says it may seek bankrupt- 
he cy protection soon, and Northwest Airlines Corp. lost 


$225 million in the second quarter of this year. 


In response, airlines have launched IT automation initiatives in areas such 
as customer service, maintenance and marketing. Those efforts are cut- 
ting costs and helping carriers operate more efficiently. 


@ Service Efficiencies 
For example, at Continental Airlines Inc., a self-service 
shopping tool for frequent fliers has helped cut costs. 
“Since 9/11, we try to use technology to lower costs and 
increase revenue where we can,” says Ron Anderson- 
Lehman, CIO at the Houston-based airline. 
Continental’s new Reward Calendar tool, which 
was launched in August 2004, is available to fre- 
quent fliers on the airline’s Web site. Customers 
are using pricing and shopping technology from 
Cambridge, Mass.-based ITA Software Inc. for 
reward travel, Anderson-Lehman says. 
In early 2003, Continental also redesigned its 
schedule and fare search engine in conjunction 
with ITA. The company needed to keep its planes 
ES full to sustain profits, but it also needed to keep 
=< sits regular customers happy by making it easy for 
- them to cash in frequent-flier miles for available 
seats. Continental was looking for a simpler system 
that would save labor by allowing customers to find 
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and book those seats themselves. 

“The challenges are to find reward availability, 
because planes are very full these days,” Anderson- 
Lehman says. “We wanted them to be able to do it 
online, because it’s expensive to have a reservation 
agent do it, and it’s also fairly complicated.” 

Using Reward Calendar, frequent fliers can search 
for and book reward travel in both economy and 
first/business-class cabins. Seat availability is dis- 
played over a two-to-four-week period based on the 
date of the preferred flight, Anderson-Lehman says. 

Taking the adage “time is money” to heart, Ameri- 
can Airlines Inc. is replacing nearly 35,000 PCs in air- 
ports, back offices and at corporate headquarters so 
employees can use more-efficient applications to 
serve customers more quickly. Susan Garcia, vice 
president of IT at the Fort Worth, Texas-based com- 
pany, says that every IT decision is based partly on 
lowering costs and improving customer service. 

Hewlett-Packard Co. is the hardware vendor on the 
project, and Electronic Data Systems Corp. is helping 
the airline with the rollout. “This allows us to do 
things like streaming video as well as some training,” 
Garcia says. “It also increases the speed at which 
agents can check people in.” 

American started what it has dubbed the Quantum 
Project earlier this year and plans to complete it at 
all domestic and international locations by the end of 
the year or early next year, Garcia says. 

Customer self-service and other IT initiatives have 
been a key part of the business plan at United Air 
Lines. Chicago-based United, which is preparing to 
emerge from bankruptcy protection, is the world’s 
second-largest airline, operating more than 3,400 
flights a day to more than 200 domestic and interna- 
tional destinations. 

“Over the past three years, as we restructured, we 
used IT significantly to reduce costs and improve 
revenue performance,” says United CIO Nirup Krish- 
marthy. “Today, IT is one of the pillars that holds up 
the business plan going forward.” 

During that time, United has installed approxi- 
mately 1,100 EasyCheck-in self-service kiosks from 
IBM at domestic airports, he says. 

The units allow passengers to perform a variety of 
transactions, including getting boarding passes, re- 
questing upgrades and even checking in bags at des- 
ignated kiosks without waiting in line at ticket coun- 
ters or gates, according to Krishmarthy. 

The kiosks use IBM PCs, touch screens, card read- 
ers and ATB2 printers. Select kiosks will be using 
RTE8000 passport scanners from U.K.-based 
Rochford Thompson Equipment Ltd. They will be 
driven by IBM’s Consumer Device Services software 
and its common use self-service, or CUSS, system. 

United is also working with Deutsche Lufthansa 
AG on a project called Common Platform that will 
replace its reservations and airport management en- 
vironment now hosted by Galileo International Inc., 
a global distribution system, says Krishmarthy. The 
ultimate goal of the IT project is to provide a com- 
mon experience for customers of the airlines that are 
part of the Star Alliance airline partnership, he says. 

Star Alliance members will share common soft- 
ware, databases and a technical platform, allowing 
them to issue tickets on other Star Alliance mem- 
bers’ flights; share information about seat availability, 
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schedules, reservations, inventory and fares; and 
even share check-in systems and other airport cus- 
tomer-service systems, says Krishmarthy. 


® Maintenance Gets IT Overhaul 


Over the past 12 months, airlines have begun looking 
into automating their maintenance, repair and over- 
haul (MRO) systems, says Henry Harteveldt, an ana- 
lyst at Forrester Research Inc. in Cambridge, Mass. 

“They’re taking a fresh look at MRO technology — 
how can it better help them schedule the planes for 
maintenance, reduce the time on the ground, and in- 
crease the accuracy and lower the cost of the mainte- 
nance work. That is one area the airlines are collec- 
tively looking at,” Harteveldt says. 

Continental is working on deploying 802.11b or 
802.llg wireless networks in its hangars for use by 
aircraft maintenance staff, Anderson-Lehman says. 

Currently, mechanics can access maintenance 
manuals and documents electronically en PCs, but 
those PCs are tethered to locations that aren’t close 
by when they’re working on the planes, he says. 

“Continental wants to be able to move those PCs 
out into the hands of the mechanics where they’re 
working so they can see the schematics about specif- 
ic equipment they’re working on,” says Anderson- 
Lehman. “We're doing this now in a hangar at the air- 
port in Houston for our heavy maintenance checks 
| on our 757s.” This technology will allow mechanics 
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to get airplanes off the ground faster because they'll 
spend less time moving back and forth between the 
tethered PCs and the planes. And that’s important 
because every minute a plane is out of service costs 
money, he says. 

Continental has also implemented a multiuser pro- 
duction coordination system designed by Sinex Avia- 
tion Technologies Corp. in Duluth, Minn., for use 
within the heavy maintenance environment. This 
software allows the airline to plan the maintenance 
work as well as assess how that work is progressing. 

“This will allow us to replace the paper-based 
process of signing off on the work that gets complet- 
ed,” Anderson-Lehman says. “Widespread use of this 
system relies on us being able to deploy wireless in- 
frastructure as well, so we’re looking at over 18 to 24 
months for rollout.” 

American is also bringing portable technology to 
its maintenance personnel, Garcia says. The airline 
has been working with Panasonic Corporation of 
North America to build a portable, ruggedized laptop 
to hold all the information the maintenance workers 
need when working on a plane, whether it’s at a gate 
or in a hangar. The Portable Technology for Line and 
Base Maintenance system will replace the current 
paper-based system, Garcia says. 

“We used a wireless network initially when we pi- 
loted the program, and we built our own infrastruc- 
ture to get the data back and forth from cur main 
servers,” she says. Eventually, as technology improved, 
the airline was able to use Sprint PCS Group’s cellular 
phone network. “Anywhere you can operate a cell 
phone, you can connect this computer,” Garcia says. 

The new systern increases productivity. Mechanics 
no longer have to hike up to half a mile to retrieve 
the information they need. It also saves money by 
increasing on-time departures, Garcia says. 


® Reaching for Revenues 

Even low-cost carriers such as Dallas-based South- 
west Airlines Co., which has posted a profit every 
year since 1972, are turning to IT to boost the bottom 
line. Like other carriers, Southwest is using market- 
ing automation tools to help increase sales. The 
airline recently developed and launched Ding, a 
Windows applet that brings live updates of South- 
west.com offers directly to customers’ desktops, says 
Tom Nealon, senior vice president and CIO. 

Once a user installs the application, the Ding icon 
will display in the PC’s system tray. Southwest can 
then deliver marketing messages to the application. 
When a message is delivered, the system will make a 
“ding” sound, and the user can click on the icon to 
display the offers 

“It’s going gangbusters,” Nealon says. “We've 
had hundreds of thousands of downloads and over 


| $20 million in fares booked through Ding since June.” 


The airline industry is changing, and the airlines 
have to change with it, says Garcia. And, she says, if 
they want to survive, the airlines have to use IT to 
cut costs, revitalize the business, keep employees 
happy and improve customer service. @ 56111 
DELTA INITIATIVES 
For more on cost-saving IT projects at Delta Air Lines, visit out Web site: 


QuickLink 56542 
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SOMEDAY, COMPUTER 
CHIPS WILL BE GROWN, 
NOT MADE. 

The concept of 
nanotechnology — that is, the manu- 
facture of preposterously small objects 
— is at least familiar to most, although 
the scales involved continue to boggle 
the mind (a pinhead is about 1 million 
nanometers wide). It’s easy to see why 
such extreme miniaturization interests 
semiconductor makers: Feeding the 
beast called Moore’s Law grows more 
difficult with every generation of chips. 

A number of companies are betting 
that the best way to operate in this 
nanoscale world is via “molecular self- 
assembly,” in which circuits literally 
grow themselves. IBM, Texas Instru- 
ments Inc., Fujitsu Ltd. and Hewlett- 
Packard Co. are focusing on incremen- 
tally self-assembled components that 
can be integrated with conventional 
silicon-based chips. Meanwhile, start- 
ups such as ZettaCore Inc. and Cam- 
brios Technologies Corp. aim to elimi- 
nate silicon completely by building en- 
tire semiconductors from molecules. 

But, experts caution, the race is not 
a sprint but a marathon whose finish 
line is 20 years off at least. 

Researchers have already shown that 
it’s possible to integrate self-assembly 
with conventional semiconductor- 
manufacturing techniques — meaning 
chips that are at least partially self- 
assembled may be found in commer- 
cially available computers in five to 
seven years, says Jack Uldrich, presi- 
dent of The NanoVeritas Group in St. 
Paul, Minn., and co-author of The Next 
Big Thing Is Really Small (Crown Busi- 
ness, 2003). 


Natural Patterns 

Self-assembly — the tendency of cer- 
tain structures to fall naturally into 
patterns — is one of nature’s most 
common occurrences. On a grand 
scale, for example, wind direction, 
temperature and moisture in the air 
result in predictable types of storms. 

Now think smaller — much smaller. 
Certain molecules combine without 
guidance in predictable ways. “Some 
molecules recognize each other and 
find natural low-energy states,” says 
W. Grant McGimpsey, a biology profes- 
sor and director of the Bioengineering 
Institute at Worcester Polytechnic 
Institute in Massachusetts. 

A common example — and one 
that’s expected to play a prominent 
role in chip making — is the SAM, or 
self-assembling monolayer. When a 
substrate and molecules with long car- 
bon chains are combined under the 





TECHNOLOGY 


Molecular 
oelf-Assemb 


Nanoscale circuits build themselves, 
breathing new life into Moore's Law. 


By Steve Ulfelder 
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right conditions, SAMs self-assemble. 

“The neat thing about SAMs is they’re 
very well ordered,” McGimpsey says. A 
field of these SAMs protrudes from the 
substrate at a well-defined angle — like 
a small patch of thick, well-tended 
grass — and can perform several du- 
ties, such as improving conductivity or 
increasing surface area. Such order, 
McGimpsey says, “means predictability 
of structure, and thus of properties.” 

To date, the management of self- 
assembled molecules that could be ap- 
plied to semiconductors is limited to 
a few basic structures. However, re- 
searchers believe that’s a benefit, not 
a drawback. 

Because of the high cost of tooling 
up, process change in the semiconduc- 
tor industry is slow. Thus, self-assembly 
is sure to make its way into integrated 





circuits only gradually. Early applica- 
tions will be simple and unglamorous. 

For example, IBM Research has used 
self-assembly to boost by 400% the 
performance of the high-capacity 
decoupling capacitor, an integrated- 
circuit component that helps maintain 
a steady, spike-free power supply. 

“Self-assembled materials form very 
simple patterns,” explains researcher 
Chuck Black of IBM Research’s York- 
town Heights, N-Y., laboratory, so that 
structures can be made far smaller than 
those resulting from lithography, the 
conventional chip-making technique. 

HP has recently spoken with bold- 
ness about nanotechnology’s role in its 
future. “We believe we have a practical, 
comprehensive strategy for moving 
computing beyond silicon to the world 
of molecular-scale electronics,” Stan 
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| Williams, a director at HP Labs, said in 


a March statement. HP is betting on 
crossbar arrays — a way to replace tra- 
ditional transistors with devices creat- 
ed by trapping a switchable layer only 
a few atoms thick between crossed 
wires. HP acknowledges that it must 
answer many questions before manu- 
facturing crossbar circuits, but one 
possibility is a self-assembly technique 
in which silicon nanowires would be 
“grown” between a pair of electrodes. 

The concept of a mass-produced 
structure with dimensions measured 
in atoms heips explain why research- 
ers are turning to nanotechnology as 
the next great hope for Moore’s Law — 
the observation, credited to Intel Corp. 
founder Gordon Moore, that the densi- 
ty of transistors on a chip doubles 
every 18 to 24 months. 

Today’s most advanced transistors 
feature gate lengths of 90nm; Intel says 
it will roll out 45nm transistors in 2007. 
That’s less than 1/5000 the width of a 
pinhead — and yet it’s an absolute 
chasm compared with a molecule, 
which is about Inm in width. 

As a result, McGimpsey points out, 
the potential to shrink chips is vast: 
“Replace all the gates on [today’s semi- 
conductors] with atoms, and you get a 
ten-thousandfold decrease in size and 
thus increase in speed.” 

One sign that limited applications 
of self-assembly are likely years rather 
than decades away from production is 
the effort that’s been made to integrate 
the technique with conventional litho- 
graphy. For example, the recent IBM 
breakthrough that most excites Black is 
a process improvement making it possi- 
ble to “register,” or align, self-assembled 
structures with those created through 
lithography. Conventional chips feature 
about 30 lithographed layers, and align- 
ing them precisely is one of the prereq- 
uisites of production. It’s a difficult 
process that will only get harder as cir- 
cuits shrink. Thus, IBM’s newly devel- 
oped ability to align self-assembled 
components “is a big breakthrough,” 
Black says. “This allows us to truly 
think about building [hybrid chips].” 

Uldrich of NanoVeritas says the 
complexity of manufacturing ever- 
smaller silicon chips and the billions 
of dollars invested worldwide in nano- 
technology research will hasten the 
arrival of full-fledged self-assembled 
chips. “This stuff is coming,” Uldrich 
says, “and it’s coming a lot sooner than 
many people believe.” @ 55987 





Ulfelder is a freelance writer in 
Southboro, Mass. Contact him at 
steve@ulfelder.com. 
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Starting Over, With 
Intrusion Detection 


There’s lots to do at our security manager’s 
new job, but sometimes budget timelines 
set your priorities. By Mathias Thurman 


S I MENTIONED in my 

last installment, I start- 

ed my new job as the 

information security 
manager for a hardware com- 
pany about a month ago. The 
company didn’t have a secu- 
rity manager for about a year 
before I was hired. 

Because of the lack of info- 
sec leadership, many of the as- 
sociated duties were absorbed 
by other depart- 
ments. For example, 
the Unix team has 
been managing the 
devices used to filter 
mail and Web traffic. 
The network team 
has been managing 
the VPN concentrators and 
firewalls. Other infosec duties, 
such as vulnerability assess- 
ments, configuration and 
patch management, weren’t 
being attended to at all or 
were being done improperly. 

For the past several weeks, 
I’ve been soaking up informa- 
tion, meeting key individuals 
and learning as much as I can 
about our network, servers 
and applications. I’ve realized 
that I’ve got a long way to go. 
And I’m also realizing that 
there are lots of rocks out 
there, the kinds of rocks that 
you lift and find lots of wrig- 
gling worms. My challenge 
will be deciding which rocks 
I want to turn over. 


Spending Decisions 


Of course, my priorities are 
determined by various factors. 
For example, I have about 
$80,000 to spend on intrusion 
detection, and I have to spend 
the money within the next 
couple of months. Because I 
don’t want to lose the chance 
that this budget item repre- 
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sents, refreshing the existing, 
somewhat limited intrusion- 
detection system infrastruc- 
ture is high on the list of 
things I need to tackle. 

My predecessor invested in 
four RealSecure Network Sen- 
sors from Internet Security 
Systems Inc. in Atlanta and 
three ManHunt sensors from 
Symantec Corp. in Cupertino, 
Calif. These seven sensors 
give us the ability to 
monitor the traffic 
at the edge of our 
network. Why do we 
have two different 
IDS sensors? My un- 
derstanding is that 
my predecessor, 
who was not very technical 
and was overwhelmed with 
the need to create policies 
dealing with the mandates of 
the Sarbanes-Oxley Act, was 
coaxed by clever sales repre- 
sentatives into purchasing 
security products, whether 
he needed them or not. 

This would explain why 
there is a Cisco Protego event 
management appliance still 
sitting in a box alongside some 
unused Cisco firewall service 
modules and lots of unopened 
scanning software. It’s not that 
these are inferior products; 
they simply weren’t needed, 
and now we’re left with a lot 


Too often, purchasing 
decisions are made 
without an evaluation, 
pilot or validation 
testing. 





of equipment and software 
that’s just lying around col- 
lecting dust. I’ve seen this sort 
of thing before. Managers 
sometimes get reeled in by 
wily sales representatives. The 
reps show up in nice clothes, 
use high-end laptops to run 
cool demos with PowerPoint 
slides and then hand out pens 
and T-shirts. They take the 
manager out for lunch a cou- 
ple of times and then pressure 
him into buying the product. 
Too often, purchasing deci- 
sions are made without an 
evaluation, pilot or validation 
testing. 

I never do business like that. 
I always take the time to install 
a product in a lab environ- 
ment and test it to determine 
whether it makes sense to de- 
ploy in my operations. Many 
times, I have discovered that 
a particular feature that was 
demonstrated by the vendor 
isn’t available in the current 
version. Or the performance 
metrics given by the sales en- 
gineer don’t account for real 
network traffic, only traffic 
generated in a lab environment 
with a packet generator. 

So, here I am, the new secu- 
rity manager, and I have a 
bunch of shelfware to deal 
with, not to mention a CIO 
who has a cautious eye be- 
cause he was burned too many 
times by signing my predeces- 
sor’s purchase requisitions. 

Getting back to my IDS 
refresh, we’re going to take a 
look at our existing coverage 
and spec out what it will take 
to get to the point where we 
can monitor all, if not most, of 
our network traffic. Currently, 
we're monitoring traffic only 
at our external gateways and 
not any of the critical applica- 
tion server traffic, corporate 
network or lab environments. 
Once we get a handle on the 
amount of traffic at each of 
those points, we can spec out 





hardware or appliances. 

If it makes sense, I may just 
scrap the ISS and Symantec 
installations and move to 
Snort, which is the open- 
source alternative. Saving 
money on software will leave 
more for hardware, and I'll be 
able to buy more sensors and 
maybe even look at event cor- 


| relation tools to help manage 


security events. 


Finding a Skill Set 


The problem is that if I deploy 
Snort, I’ll most likely need an 
almost-full-time employee to 
manage the infrastructure. 
Currently, I don’t have any 
good Linux administrators 
in my department, and I feel 
that knowledge of Linux and 
the ability to write scripts are 
critical in managing a robust 
Snort infrastructure. If I can’t 
get that technical skill set, then 
I may have to look to a com- 
mercial alternative. Columbia, 
Md.-based Sourcefire Inc. has 
several appliances that may 
serve as a low-cost, supported 
alternative. Once I get my 
arms around the scope of our 
needs, I can make the decision 
on what and where I will 
spend my money. 

I’m also interested in getting 
a robust intrusion-prevention 
infrastructure. Although we’ve 
been lucky that we haven’t 


| been hit by the recent worms 


written to take advantage of 
the Microsoft plug-and-play 
vulnerability, I want to ensure 
that our corporate network is 
protected from unsuspecting 
employees, as well as from un- 
trusted networks such as labs, 
VPN segments, partner con- 
nections and some core appli- 
cations such as Outlook Web 
Access. Many IDS vendors 
also offer intrusion-prevention 
systems, so once we decide on 
one, I’m sure we'll take a good 
hard look at that vendor’s IPS 
offering as well. B 


WHAT DO YOU THINK? 

This week's journal is written by a real securi- 
ty manager, “Mathias Thurman,” whose 
name and employer have been disguised for 
obvious reasons. Contact him at mathias_ 
thurman@yahoo.com, or join the discussion 
in our forum: QuickLink a1590 
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Microsoft Releases 
Beta of WinFS 


Microsoft Corp. last week re- 
leased the first beta copy of its 
WinFS storage subsystem to its 


developer network. The beta runs | 


on Windows XP. WinFS will still 
be in beta in late 2006, when 
Windows Vista is due to ship, 
according to Quentin Clark, direc- 
tor of program management for 
WinFS at Microsoft. The company 
will release WinFS as an add-on 
after Windows Vista, Clark said. 


3Com Offers 
Remote Module 


3Com Corp. in Marlboro, Mass., 
has announced the 3Com IP 
Telecommuting module. The 
product allows large companies 
to provide remote users with se- 
cure access to communications 
applications, 3Com said. The 
module relies on technology from 
Ingate Systems Inc. It sells for 
$80 per user. 


Sybase Upgrades 
Wireless App 


Data integration and database 
software maker Sybase Inc. in 
Dublin, Calif., last month an- 
nounced the Sybase Unwired Ac- 
celerator 7.0. The application has 
a new wizard to connect mobile 
devices with SAP applications. It 
is available now, at a cost of 
$29,000 per CPU. 


Journyx Updates 
Timesheet Tool 


Journyx Inc. introduced Version 7 
of its Timesheet system. New fea- 
tures for the Web-based time- 
sheet and expense management 
system include a workflow mech- 
anism for adding users and proj- 
ects, according to Austin-based 
Journyx. Timesheet 7.0, which 
runs on Linux, Windows, IBM’s 
AIX and Sun Solaris, is priced 
from $100 to $200 per user for a 
permanent license, or $8 to $10 
per month per user under an ap- 
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Too Much ETL Signals 
Poor Data Management 


O PUT IT BLUNTLY, performing extensive 
extract, transform and load (ETL) process- 
es is a symptom of poorly managed data 
and a fundamental lack of a cogently de- 
veloped data strategy. When data is man- 
aged correctly as an enterprise asset, then ETL is 
significantly reduced and in many cases completely 


eradicated. Now, I realize 
that this is a provocative 
statement, but in my esti- 
mation, ETL is overused 
within the IT community, 
leading to inefficiency and 
unnecessary expense. 

ETL gained popularity as 
companies began to out- 
grow antiquated systems. 
As functionality was moved 
from legacy systems to 
open systems architectures, 


ETL played an indispens- ION ro 


able role in moving the data. Unfortu- 
nately, many companies failed to com- 
pletely retire their outdated systems; 
rather than performing ETL as a one- 
time initial load event, ETL evolved 
into a part of daily operations. 

This problem was further exacerbat 
ed as companies developed systems 
within functional silos. The applica- 
tion-specific approach, in which the 
database is designed to accommodate 
the needs of an individual group or de 
partment, took root. According to this 
methodology, every new system re- 
quires its own database. As a result, 
data is copied from system to system. 
Hence, ETL is now firmly ensconced 
in nearly every company and is an in- 
tegral part of IT operations. 

Consider a simplified example of 
typical ETL activities, in which data is 
propagated from the product system 
into warranty, finance, purchasing and 
sales systems, and eventually into the 
data warehouse. Not only is the data 
extracted and loaded, but it must also 





be transformed because 
the data structures be- 
tween systems are com- 
pletely disparate. 

This problem is com- 
pounded when the data is 
propagated back to the 
source system in order to 
synchronize the data that’s 
no longer synchronized 
between systems precisely 
because it was copied. The 
inevitable result is poor 

data quality and high 
maintenance costs. 

If the product database in this ex- 
ample changes — for instance, if a new 
field or table is added — it will be nec- 
essary to change all of the maps that 
move data from the source to a target. 
One minor structural change in the 
source can create a maintenance 


| nightmare in the ETL maps and target 


databases — a lot of IT expense with 
no value added. 

The only legitimate ETL activity in 
this example is the data warehouse in- 
terface. All others are unnecessary and 
incur a tremendous cost. According to 
Larry English, president of Informa- 
tion Impact International and a lead- 
ing expert in information quality, “The 
IS staff is busy maintaining, on aver- 
age, a tenfold [increase in] redundant 
databases and the redundant applica- 
tions or interface programs that re- 
create or move the data.” Ouch. 

The solution to the problem is really 
quite simple, but it requires a new way 
of thinking. The answer is a single, 





sharable, enterprise-strength database 
for each major subject area. The key is 
to design each of these databases to 
meet the needs of all of the informa- 
tion consumers. 

With the advent of new technology, 
there is absolutely no need to propa- 
gate data from system to system, 
thereby creating unnecessary (and ex- 
pensive) redundancy. Applications can 
now access data via shared services 
from different databases. 

Information is a corporate asset and 
doesn’t belong to one group or depart- 
ment. Therefore, databases must be 
designed and implemented with both 
producer and consumer in mind. The 
entire company must be involved in 
defining entities and attributes and 
modeling relationships. 

To support this new way of thinking, 
applications can’t be designed in a vac- 
uum. IT must re-engineer applications 
to use common, shared databases cen- 
tered on the significant subject areas. 
The database, and not the application, 
is the center of the universe. 

There’s a simple rule I use to deter- 
mine whether a company has an effec- 
tive data strategy. I start by counting 
the number of ETL processes and re- 
dundant databases. The higher the 
number, the less likely it is that the 
company manages its data correctly. 

Next, I ask, “Why did you create an- 
other database with similar data?” Of- 
ten the answer is that the data is not in 
the right format or doesn’t support the 
new application, or the source is in- 
complete and inaccurate. And then I 
know that the company is wasting 
money and resources performing 
unnecessary, costly maintenance and 
development rather than producing 
value-added services based on sound 
data management techniques. @ 56514 
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OPINION 

Too Much Information 

Want people to remember what you 
7? Paul Glen suggests that you 

moderate your verbal torrent to 

a trickle of well-chosen words. 
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IT certifications 

are everywhere, 
but what do they 
really prove? 


BY MARY K. 
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OSTON MEDICAL CENTER 
and Boston-based Part- 


Inc. hire entry-level 
technical workers through At- 
lantic Associates Inc. Both orga- 
nizations look for similar quali- 
ties in their new hires, but there’s 
one telling difference: Boston 
Medical Center specifically seeks 
to employ workers with certifica- 
tions such as A+ and Microsoft 
Certified Professional. “We think 
it’s an indicator of professional- 


| 
| 
| 
| 
| 
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ism and dedication to the indus- 


| try,” says Darren Dworkin, chief 
ners HealthCare Systems | 


technology officer at Boston 
Medical Center. 

While Dworkin stops short of 
calling certifications a require- 


ferentiate between candidates. 


help desk at Partners, sees certi- 


fication as a bonus but not neces- | 


sarily a differentiator. “I have 
people with certification and 
without. I would challenge you to 


tell me who was which,” he says. 
So, who has it right, Dworkin 

or Severo? Can certifications 

really tell something about the 


| people who hold them, or are they 
| minor points on résumés today? 
ment, he says he uses them to dif- | " 

| Downward Slide 

Carlo Severo, who manages the | 
| have lost some of their allure. A 


Lately, certifications seem to 


study by Foote Partners LLC, a 
research firm in New Canaan, 


| Conn., shows that for the 12- 


month period that ended April 1, 
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noncertified workers received a larger average pay 
increase than those with certifications — 3.6% com- 
pared with 2.9%. 

Some say the study shows a shift in the value IT 
executives place on certifications. 

“It’s being put in its right place,” says Robert 
Miano, president and CEO of Harvey Nash USA, 
the U.S. arm of London-based Harvey Nash PLC, a 
global recruitment company. “Certifications are go- 
ing to stay, but they’re not as highly regarded as they 
have been in the past.” 

Miano says he has seen a change in the way the 
market treats certifications, which were initially well 
received. He says they have become “watered-down 
and diluted” as the number of certifications and 
third-party teaching centers has grown. Certification 
exams have also become less stringent, he says. 

“What has happened is the value of certification 
has gone down because you can get it so easily,” he 
adds. “Companies realize that certification isn’t as 
meaningful as it used to be.” 

As a result, Miano says, his clients put a higher val- 
ue on experience. 

William Butler, an IT technician at the Gilmer In- 
dependent School District in Gilmer, Texas, has also 
seen this shift during his nearly 20 years in IT. “Cer- 
tification at one point was a standard that could be 
used to gauge an individual’s proficiency. That was in 
the early years,” he says. Now most certifications are 
awarded by vendors and “seem to be more of a vehi- 
cle to promote their products.” 

Butler has no certifications; he says he has relied 
on his reputation to advance his career. 

Jerry Luftman, associate dean of graduate IT pro- 
grams at Stevens Institute of Technology in Hobo- 
ken, NJ., and an officer of the Society for Informa- 
tion Management (SIM) in Chicago, also downplays 
the value of certifications. 

“I would certainly weigh experience as much more 
valuable than a score on an exam,” Luftman says, 
adding that he sees IT employers increasingly seek- 
ing out marketing, communication and leadership 
skills that aren’t measured by any exam. 

The Foote research “certainly suggests that one 
should question the merits of the certifications,” says 
Luftman. “But again, is technology the only criteria a 
manager uses to give pay increases? No.” 

Others agree that job offers and compensation 
ought to be based on factors ranging from experience 
to attitude. “There are other key criteria you’re not 
going to get through certification,” says Stephen 
Pickett, CIO at Penske Corp. in Bloomfield Hills, 
Mich., and president-elect of SIM. 

And Pickett confirms the Foote study’s findings 
that people with certification don’t necessarily com- 
mand higher pay: “I’m going to pay the same money 
for the same base knowledge,” he says. 

That's why many say experience is the real key. 

“If you have someone with experience but no certifi- 
cation vs. someone with certification but no experi- 
ence, you're going to take the person with experi- 
ence,” says Jack Harrington, president of Atlantic 
Associates, a Boston-based firm specializing in IT 
staffing and consulting. 

Brian Ellis, a network analyst working as a part- 
time contractor at Massachusetts General Hospital, 
is a good case in point. Ellis is a Microsoft Certified 
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A Better Way’? 


WILLIAM BUTLER deviated from 
the standard teaching material when 
he taught A+ and N+ certification 
courses a few years ago to students 
studying desktop configuration and 
networking. 

Butler, an IT technician with the 
Gilmer Independent School District, 
says he threw “kinks” into the usual 
course work. He wanted his stu- 
dents to learn to apply book-based 
knowledge to real work situations - 


they have done that,” says Jerry 
Luftman, associate dean of graduate 
IT programs at Stevens Institute of 
Technology. 

Butler goes even further. He sug- 
gests an overhaul that would apply 
old-fashioned learning methods to 
high-tech jobs. “Have an individual 
apprentice, much the way that li- 
censed electricians do,” he says. “At 


| the end of the apprenticeship, they'll 


receive their certification.” 
Anew certification moves in that 


technology consortium in San Fran- 
cisco, recently started a certification 
program that defines a set of stan- 
dards for measuring the skills and 
experience of IT architects [Quick- 
Link 55592]. “The thrust of our pro- 
gram is experience,” says Graham 
Bird, vice president of marketing at 
The Open Group. “What candidates 
have to demonstrate for this certifi- 
cation is all about doing the job.” 
Bird says there’s a need to sepa- 
rate architects with proven track 





something he says standard courses 
often fail to teach. 

He's not alone in his belief. Other 
IT leaders also say certification 
courses don't always teach students 
to apply their knowledge to everyday 
IT problems. They say the process 
needs to be strengthened if certifi- 
cations are to retain their value. 

“| would love to see certification 
demonstrate that performing well on 
the exams correlates to one’s suc- 
cess in using that tool. | don’t think 





Professional and holds A+ and N+ certifications. He 
says he considered going for the Microsoft Certified 


| Systems Engineer certification but opted against it. “I 


have five years as a systems engineer with Microsoft 
products. I don’t feel like I need to prove that I can 
pass a test,” he says. 

Ellis adds that he’s busy enough — and well com- 
pensated — with his work at MGH and as an owner 
of a Concerto Networks Inc. franchise in Stoneham, 
Mass. “I will probably never get certified in anything 
else,” he says. “Continuing education is important. 
It’s absolutely important. But I’m not a big fan of 
certifications.” 


On the Other Hand 


Not everyone shares Ellis’ views. In fact, some man- 
agers still place a high value on IT certifications. 
Pickett says many IT managers see certifications as a 
sign of a self-starter who is willing to learn. He says 
that when he reviews entry-level candidates who 
have just a few years of work experience, certifica- 
tions are “a good differentiator, but not the final 
decision.” 

Certifications are also valuable for midlevel pro- 
fessionals charged with very specific duties, he adds. 
That’s when Microsoft, Oracle or Cisco certifications 
are desirable — though they're still no substitute for 
experience on those vendors’ systems. 

Though some managers claim that experience 
trumps certifications, Harrington says his clients still 
prefer to see certifications on applicants’ résumés. 
Clients particularly want certifications in newer 


direction. The Open Group LLC, a 





records from job seekers padding 
their résumés. The new certification 
would let employers quickly know a 
candidate's qualifications, he says. 

To earn this certification, appli- 
cants will have to go before a board 
of their peers to prove their skills. 
“It's not a ‘Can | take an hour exam?” 
type [of] exercise,” Bird says. “This 
program is intended to capitalize on 
the value of experience.” 

-Mary K. Pratt 





technologies, such as Linux, and they’re willing to 
pay for them. “It is a good selling tool if you're certi- 
fied,” Harrington says. 

Sharyle Doherty, vice president of product man- 
agement at The Ultimate Software Group Inc. in 
Weston, Fla., sought someone with a security-related 
certification when the company created a security 
analyst position. “We look at certifications as an indi- 
cator that someone has gone the extra mile to prove 
their experience in a certain field,” says Doherty. 

When Doherty couldn't find a certified security 
expert, she sent an in-house worker for certification 
to fill the new position. The worker was compensat- 
ed for the training. “We consider it an accomplish- 
ment and something to reward her for,” Doherty 
says. 

So the verdict? IT certifications are neither a guar- 
anteed money magnet nor a guaranteed waste of 
time. They may indicate drive as well as knowledge, 
but they can’t measure experience or non-IT skills. 
Executives, hiring managers and workers at all levels 
conclude that it’s best to consider them as just one 
part of the overall picture. “If [job candidates] aren’t 
certified, it’s not going to prevent them from being 
hired. It’s more of an added bonus,” Doherty says. 
“But you still have to check into their actual job ex- 
perience — that it’s not just book knowledge, that it’s 
knowledge they can apply.” @ 56336 





Pratt is a Computerworld contributing writer 
in Waltham, Mass. You can contact her at 
marykpratt@verizon.net. 
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REASONS 
Do lt Yourself 


Software licensing headaches and 
maturing offshore development 
services are inspiring maverick 
I'l shops to build rather than buy. 
BY PATRICK THIBODEAU 


ICHARD HOFFMAN is not 

a fan of software licensing 

terms. “Every time you are 

on somebody’s proprietary 
[software], they always try to come 
back and milk you,” he says. 

But the president and CEO of 
Hyundai Information Service North 
America LLC, the IT arm of Hyundai 
Motor America, has found a partial 
solution to the problem: building his 
own software offshore. 

“We do a lot more customization 
and writing of small applications than 
before,” says Hoffman. 

That gets him out of annoying li- 
censing situations, such as the time 
a software vendor wanted to change 
licensing from concurrent users to 
named seats. Charging for every user, 
not just those who used the system at 
any given time, would have raised the 
automaker’s cost by $3,300 per seat. 
“You are better off just having some 
Java coders write it and pay them to 
maintain it offshore,” says Hoffman, 
adding that most of the applications 
he has built are for nonstrategic Web 
services-related processes. 

Hyundai's Fountain Valley, Calif.- 
based company isn’t alone. A few other 
maverick IT shops are bucking the buy 
trend and building their own software. 
Their reasons include the perennial 
problem of off-the-shelf software not 
meeting their needs, but there’s also a 





new level of annoyance with licensing 
issues and a new confidence in off- 
shore development. 


Off the Grid 


Acxiom Corp., a data integration pro- 
vider in Little Rock, Ark., runs its 
6,000-node grid (two processors per 
node) on software built by its in-house 
development team. 

Acxiom takes a hybrid approach to 
software, says Ken Archer, product 
leader for customer information infra- 
structure. It uses commercial packages 





| wherever it can but builds its own 
| when it makes more sense to do so. 


For example, when Acxiom began 
building out its grid in 1999, few ma- 
ture software packages were available. 
Moreover, many application providers 
license software in ways that are ill 
adapted for grid environments. For in- 
stance, a license based on the number 
of CPUs used to run an application 


| isn’t suited for a grid environment that 


can scale across hundreds or thou- 
sands of processors, Archer says. 

Unlike Hyundai Information Ser- 
vice, Acxiom doesn’t use offshore 
development, because it has in-house 
expertise, Archer says. The company 
is also helped by its Arkansas location, 
where prevailing wages for IT skills 
are typically below those in major 
metropolitan markets. 

For other CIOs, low-cost offshore 
development may be encouraging an- 
other look at the build option, particu- 
larly if they need to customize a pack- 
aged product, says Andrew Bartels, an 
analyst at Forrester Research Inc. in 
Cambridge, Mass. It may be less ex- 
pensive to build an application and pay 
maintenance fees to an offshore devel- 
oper than it is to buy a license as well 
as service and support, he says. 

“The build argument is becoming 
more viable because people are feeling 
very comfortable with the maturity 
of offshore operations,” adds Atul 
Vashistha, CEO of NeolT.com Inc., a 
consulting firm in San Ramon, Calif. 

Recognizing that interest in custom 
development is growing, Indian firms 
have made it more attractive, says 
Lance Travis, an analyst at AMR Re- 
search Inc. in Boston. Indian offshore 
providers have ready-made compo- 
nents that can be the foundation of 


NANCY RITTER has taken a third 
approach to the buy-or-build question. 

The vice president of information tech- 
nology at Crowley Maritime Corp., an 
Oaldand-based shipper, is using on- 
demand software hosted by Alameda, 
Calif.-based GT Nexus inc. The software 
powers transportation and logistics sys- 
tems to connect suppliers and customers 
with her company. 

Ritter says she likes the flexibility of the 
software-as-service model, But while Rit- 
ter doesn't build applications, except in 


A Third Way 


limited instances, she says offshore de- 
velopment has already reduced the cost 
of the software she buys. 

For example, when one transportation 
software vendor began using less-expen- 
sive offshore maintenance and support, 
Ritter demanded contract terms that en- 
abled her to take advantage of the ven- 
dor's reduced costs. The vendor agreed 
to cut its maintenance charges by 
$25,000 per year for the next four years 
to reflect that savings, she says. 

~ Patrick Thibodeau 











The basic arguments in the buy-vs.- 
build debate remain unchanged. 


Avoid painful vendor licensing terms 
Gain competitive advantage 

Adapt to new technology, 

Tee emt 


Nel mM MO Ses} 
of scale 
- Gain broader integration capabilities 
Ensure that code knowledge 
NVM em eat 


an application in a particular industry, 
he says. 

For instance, Patni Computer Sys- 
tems Ltd., which does custom develop- 
ment for financial services and other 
vertical markets, has created templates 
that provide the underlying code infra- 
structure. It augments that infrastruc- 
ture with third-party vendor products, 
such as those made by content man- 
agement firm FileNet Corp., according 
to John Pierce, vice president of insur- 
ance industry solutions at Mumbai, 
India-based Patni. 


Still a Niche 


Bartels says homegrown systems will 
account for as much as one-third of 
U.S. businesses’ total software spend- 
ing this year, which Forrester estimates 
will be about $221 billion. Neverthe- 
less, he says, the long-term shift to 
off-the-shelf applications continues. 

Offshore vendors agree. “I don’t 
think the fundamentals of build vs. buy 
have changed,” says Marc Hebert, ex- 
ecutive vice president of marketing at 
Sierra Atlantic Inc., a Fremont, Calif.- 
based provider of offshore services. “I 
think that was an irreversible shift,” he 
says, because the selection of packaged 
software that’s available these days is 
“much richer” than it used to be. 

“The trend will be to leverage as 
much commercial software as possible, 
because the focus is on putting the 
pieces together to solve a problem,” 
Hebert says. 

Acxiom’s Archer agrees. He sees his 
in-house development as a stopgap 
measure necessary because commer- 
cial providers don’t offer the function- 
ality and flexibility he needs. But 
Archer says that when packaged soft- 
ware is available that can meet his 
company’s requirements, that’s what 
he’ll use, because he would rather 
focus his IT staff on customer needs 
than in-house development. @ 56339 
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N FOOD FOR IT EXECUTIVES 


SOURCE: ALINEAN INC., ORLANDO. JUNE 2005 


The High Cost of 
IT Complexity 


MANAGEMENT 


Cis KNOW INTUITIVELY that too much 


customization and a hodgepodge of 


IT products will boost costs. Yet when : 


business managers have argued that 
their particular group has “unique” 
needs requiring yet another custom 
system, ClOs haven't had a strong 
counterargument in favor of stan- 
dardization. 


But a study of 250 companies by 
benchmarking firm The Hackett 
Group in Atlanta may provide the am- 
munition ClOs need to defeat the 
customization argument, says David 
Hebert, IT practice leader at Hackett. 
The study found that companies that 
fail to reduce the complexity of IT 
spend 30% more on finance opera- 
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Best Bits 


The most useful parts of recent business and 


THE BOOK: Offshoring Information 
Technology: Sourcing and 

Outsourcing to a Global 

Workforce, by Erran Carmel and 

Paul Tjia (Cambridge University 

Press, 2005). 

It looks and feels like a stodgy 

college textbook, but there are 

some fascinating insights here for 

IT executives who can get over 

that hump. The superb content 

isn’t surprising once you realize 

that co-author Erran Carmel, an 

associate professor at American 

University in Washington, was a 

leading expert on globally dispersed software 
teams long before CNN's Lou Dobbs ever heard of 
offshore outsourcing. 

Refreshingly, the authors don’t take a political 
stance. “Whether one is for it or afraid of it, we are 
convinced that managing offshoring is a compe- 
tency that tomorrow's IT managers must learn. We 
wrote this book to help build that competence,” 


: higher at companies that have more 
: than 10 finance applications or lack a 
: global standard for HR apps, Hackett 
: found. IT costs go up because there 
: are more hardware and software 

: vendors to deal with, more customer 
: and supplier databases to manage 

> and integrate - and more incompati- 
? ble data. 


But IT organizations that keep a lid 


: on complexity spend 15% less than 


their peers and operate with 36% 


: fewer staffers while bringing in proj- 
ects on time and under budget 25% 
: more often, Hackett found. With data 


se eeeereeeessesess 


like this, Hebert says, ClOs will be 
able to educate business managers 
so they can make informed decisions 
about whether there’s really a strong 
business case for deviating from the 
corporate standard. 

- Mitch Betts 


the authors begin in typically no-nonsense fashion. 
As you'd expect, the book has country sketches 

and thoroughly covers subjects such as managing 

contractors, risks and legal issues. But for me, the 

richest sections deal with “soft” topics like cross- 
cultural issues and overcoming 
the problems of distance, time 
zones and language. 

For example, there's a great 
danger of miscommunication 
with Indian IT workers if Ameri- 
cans use slang, business code 
words or too-subtle hints. An 

> American who says, “I was a 
F bit disappointed that...” may 
actually be upset, but the Indi- 
an may interpret that statement 
as “It doesn't really matter.” 
And while American IT workers 
use the word contractoras a business term, in In- 
dia, the term could mean one who cleans toilets. 
Don't fly to Bangalore without reading this 
book. @ 56352 
- Mitch Betts 
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4 atm e U) 
month's guest Premier 100 IT 
Leader, answering readers’ ques- 
tions about leading an IT depart- 
ment and avoiding a dead-end ca- 
cm LUM Lm OUR Near Me 0 (ra tle) 
you'd like to pose to one of our 
Premier 100 IT Leaders, send it to 


and watch for this column each 
ULL 


I've spent five years of a 16-year ca- 
reer at a small company, managing 
all of IT. | can accept another full 
leadership role at a small company or 
join a very large company in a job re- 
quiring specialization. Would that de- 
tract from gaining a leadership role in 
the future? If you have just been manag- 
ing IT rather than truly leading, the transi- 


tion to a larger company could be challeng- 


ing. Besides specializing, you'll be taking 
direction from managers who may lack 
your breadth of experience. While it's diffi- 
cult to become an effective general man- 
ager able to run an IT shop as though it 
was a complete small business, once you 
have mastered this, it’s even more difficult 
to go back to a narrower functional role. In 
this case, an organization of similar size, 
perhaps one that offers the opportunity to 
have more direct business operations in- 


volvement, might be a better fit. 

If, however, you've truly been leading 
your team, adjusting to a larger organization 
may require some compromises, but lead- 
ership skills are in such short supply that 
you'll likely do well anywhere such skills 
are recognized and valued. Make sure the 
company really does value leadership, 
though. Not everyone who says so does. 


I’ve taken classes and applied for po- 
sitions in other areas, but | continue 
to work as a systems programmer on 
a mainframe that is destined for the 
scrap heap. How do | break into other 
technologies and avoid the unemploy- 
ment line? Despite the rumors, | see 

no real sign that the mainframe is going 
away anytime soon. No other platform can 
offer large corporations the same power, 
throughput and reliability. | do see the mid- 
size mainframe as an endangered species, 
however, and non-IBM mainframes are 
definitely on the way out. So if you are in- 
volved in either of those scenarios, you are 
right to be concerned. 

What is changing is the role of the main- 
frame - from a very large, general-purpose 
computer in need of constant attention by 
systems programmers to machines in more 
specialized transaction, database or virtual 
server roles. The systems programmer role 
is evolving alongside these changes. Ask 
yourself some basic questions: What do | 
really know about? What skills underlie the 
work | do? Where do | see areas where 
these skills and knowledge would also ap- 
ply? Increasingly, areas of security archi- 
tecture, asset management, network man- 
agement and data center operations re- 
quire skills similar to the skills of systems 
programmers. Sure, the technology is dif- 
ferent, but you will likely find the process 
and problem-solving approaches familiar. 
@ 56293 
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‘Testing, lesting 


WHEN YOU'RE TRYING to fill an 
open position, how do you know which 
candidate will perform best in the job? 
Every interviewer has a different style, 
making for some apples-to-oranges 
comparisons. And it can be difficult in a 
typical job interview to assess a candi- 
date’s skills and whether he’s a good 
match for the position. 

To address these problems, Taleo 
Corp., a San Francisco-based provider 
of talent management systems, is offer- 


ing companies a pre-employment as- 
sessment service. Taleo CEO Michael 
Gregoire sees the tests as a good fit for 
IT recruiters. 

“If you're an IT manager and you're 
looking for a Java developer,” he says, 
“what is the definition of being a work- 
ing expert? If you have a set of ques- 
tions that define what an expert is, that 
will go a long way toward helping you 
during the hiring process.” 


- Thomas Hoffman 


Go Ahead, Test Me 


How would you most likely react if a 

company were to ask you to take a 
skills assessment as part of the 
application-screening process? 


Would take the test 


Would refuse the test 
2% 


SOURCE: TOPCODER EMPLOYMENT SERVICES ONLINE SURVEY OF 543 PROGRAMMERS 


Leadership: A Lot isn’t Working 


U.S. workers have doubts about the leaders of their companies 


The 2005 What's Working survey, conducted by Mercer Human Resource 
Consulting LLC in the first quarter of this year, found that two of every three 
workers say itiey feel a strong sense of commitment to their organizations. 
But there was much in the survey's findings to suggest that companies’ leaders 
aren't winning the confidence of the troops. 


Senior management does a good job of explaining the reasons 
behind important business decisions. 
31% 


38% 


Senior management at my organization does a good job of 
confronting issues before they become major problems. 


39% 32% 29% 

| trust management in my organization to always communicate honestly. 
40% 23% 37% 
| believe my organization as a whole is well managed. 
49% 26% 25% 


Senior management communicates a clear vision of the 
future direction of my organization. 
27% 


49% 24% 


Senior management of my organization does a good job 
of establishing clear objectives. 


92% 27% _ 21% 
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EVENTS 


Innovation 


@ Sept. 27-28, New York 
Sponsor: Forrester Research Inc. 


Consumer Forum 2005: Innovating 


ina Consumer-Driven World covers | 


topics such as media, retail and 
product innovation; reinventing the 
customer relationship; balancing 
proprietary and open standards; 
social blogging; and open forums 
on vertical industry innovation. 
www.forrester.com/consumer2005 


Collaboration 


& Sept. 27-28, New York 
Sponsor: Information Today Inc. 


Connect & Collaborate: Social Net- 
working & Collaboration Inside the 
Enterprise covers topics such as 
getting returns on investment; col- 
laboration technology, trends and 
tools; the case for community- 
building; wikis; group blogs and the 
wisdom of crowds; new tools for 
content management; effective 
workplaces; messaging for enter- 
prise productivity; and collaborative 
workflow and the bottom line. 
www.connectcollaborate.com 


Emerging 
Technologies 


@ Sept. 28-29, Cambridge, Mass. 
Sponsor: Technology Review 


The fifth annual Emerging Tech- 
nologies Conference at MIT in- 
cludes sessions on computing for 
developing nations, truly intelligent 
machines, social computing, bio/ 
nano frontiers, open-source going 
mainstream and tomorrow's engi- 
neering crisis. www.tretc.com 


Risk Management 


® Nov. 14, San Francisco 
Sponsor: Robert Frances Group Inc. 


Reducing Risk, Restoring Trust 
covers topics such as minimizing 
risk when translating laws into cor- 
porate policy, risk controls and met- 
rics for third parties, risk metrics 
and dashboards, data protection, 
risk vs. audit, compliance roles 

and responsibilities, and IT risk 
roles and responsibilities. 
www.rigonline.com 


| 
| 
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‘Too Much 
Information 


ECHNICAL PEOPLE have a bad reputation 
for being poor communicators. And un- 
fortunately, it’s not entirely undeserved. 
If you ask managers in the finance de- 
partment about why they think that the IT 
people they deal with are bad communicators, they 
point to all the common complaints. 


“They speak in impene- 
trable jargon.” 

“They don’t listen well.” 

“They don’t understand 
what I’m trying to accom- 
plish.” 

While these are some- 
times valid critiques, the 
problem often lies else- 
where. Frequently, we do 
listen well and we do un- 
derstand what the business 
wants to do. (OK, the jar- 
gon thing is fair.) 

The real problem was 
driven home for me recent- 
ly at a conference where I 
was giving a presentation. 

I came early to hear what some of 
the other speakers had to say. They 
clearly articulated lots of interesting 
ideas. But ultimately, many failed to 
transmit the key points that they 
wanted to share. 

Why? They simply ran out of time. 
I was surprised at how consistently 
the conference managers needed to 
give presenters the hook in order to 
keep the day remotely on schedule. 
After 15 minutes, presenters were still 
talking about slide No. 4 of 40, and it 
was Clear that we weren’t going to get 
the discussion we really wanted out of 
the talks. 

It wasn’t that their information was 
uninteresting or poorly organized or 
padded with irrelevant data. The prob- 
lem was that the more information a 
presenter wanted to share, the less we 





in the audience received. 
The presenters were so 
enamored of their own 
ideas that they couldn’t 
condense them into a form 
for others to digest. Every 
detail was so precious that 
they couldn’t part with a 
single one. 

Unfortunately for the 
audience, that meant that 
they didn’t get much of 
anything. They were being 
assaulted with too much 
information and lost the 
main ideas in the on- 
slaught. 

I’ve found that this is 


| acommon problem, not just on the 


speaking platform, but in most offices. 
CEOs dismiss CIOs as being hopeless- 
ly mired in details and unsuitable for 
higher management posts because 


| they can’t communicate the core of an 


issue in a paragraph or less. Clients 
write off project managers because 
they can’t pull the important message 
out of the complete picture. Business 
analysts consider developers hopeless- 
ly technical because they won't relate 
important information in a format that 


| others can use. 


As problem solvers, we delude our- 
selves into thinking that others can’t 
understand anything about a problem 
without understanding everything 
about it. 

If you'd like to be a better communi- 
cator and overcome the too-much- 





information problem, here are a few 
things to think about before you open 
your mouth: 

What do you want them to remember from 
the conversation an hour from now? Man- 
agers, clients and subordinates are 
barraged with information and data 
all day, every day. Most of it passes 
through their brains like cars through 
a freeway interchange. Think carefully 
about what you want them to recall in 
an hour. If you were to go back and ask 
them what the conversation was about, 
what would you want them to say? 

The half-life of information is short. 
What falls outside of that recollection 
window may be irrelevant detail that’s 
better left unsaid. 

What do you want them to remember from 


| the conversation a week from now? If it’s 


hard to retain information for an hour, 
think about a whole week. What do 


| you want your audience members to 


remember a week after your discus- 
sion? Realistically, it will be consider- 
ably less than what they will recall af- 
ter an hour. 

What do you want them to do with the 
information? Most business communi- 
cation has a purpose beyond just self- 
expression. Usually, the motive is 
either calibration — keeping others 
informed of progress and approach — 
or action. If it’s calibration alone, the 
previous two questions should guide 
your communication. If you want peo- 
ple to make a decision or take action, 
tell them what you want them to do. 
And give them the information they 
need to carry out that action. 

If you want your words to carry 
more weight, start by cutting down 
on the number you use. Powerful com- 
municators say more with less rather 


than less with more. @ 56338 





| WANT OUR OPINION? 


For more columns and links to our archives, go to 
www.computerworld.com/opinions 





IT Manager: Manage onsite 
public employees retirement 
system IT project in Topeka, KS. 
using expertise/capabilities in 
both functional analysis/imple- 
mentation and technical devel- 
opment of intranet/internet solu- 
tions using .NET technologies, 
C#, AS 400, Delphi, XML, UML 
Requires a graduate degree in 
engineering, 4 years of experi- 
ence in management of public 
employees retirement system 
IT project involving both func- 
tional & technical development 
Send application to Sagitec 
P.O. Box 211285, Eagan, MN 
55121 


Programmer Analysts 
Design, develop, inte- 
grate, & test multi-tier 
Enterprise Applications, 
System Integration using 
XML, Web Logic, Unix, 
Pro C, SOAP, Databases 
such as Oracle, Tandem 
SQL MP. Req. B.S in 
Comp. Sci. or Engg. & 2 
yrs of exp. Send resume 
to: HR. Panex KPIT, 
10701 Corporate Dr., Ste 
380, Stafford, TX 77477. 


COMSYS 


With 35 branch offices located 
across the US, COMSYS is ac- 
tively recruiting for the following 
positions. 


Software Engineer metro 
Raleigh, NC — Code # RA100 
Programmer Analyst metro 
Washington, DC—Code # SS100. 
Software Engineer metro 
Plano, TX — Code # PL100 
Programmer Analyst metro 
St. Louis, MO — Code # MH100. 


Roving employment to varying 
jobsites throughout the US. 
Please refer to appropriate job 
code when submitting resume to 
COMSYS, Attn. Nancy Theriault 
15455 N. Dallas Pkwy., Ste 300. 
Addison, TX 75001.EOE./MF/DV 


Software Engineers: Design 
& develop Web Applications 
for EAI, ERP &, CRM applica- 
tions. Design client-server 
applications using Java, Mid- 
dleware technologies (Tibco 
Business Works, Rendez- 
vous, WebMethods, & See- 
Beyond ICAN), ASP.NET, 
VB.Net & knowledge in data- 
bases. Need Bachelor's in 
Comp. Sci. or Engg. or relat- 
ed & 2 yrs of exp. Send 
Resume to H.R. Indus Valley 
Consultants, Inc, 140 W 
Kemper Rd, Cincinnati, OH 
45246 


MIS Manager: Analyze, develop 
information resources: provide 
strategic data & security, & dis- 
aster recovery. Knowledge in 
ERP packages using SAP, .NET, 
Business Objects, Peo-pleSoft, 
SQL/Ore UNIX/NT. Req 
M.S. in Comp. Sci. or Engg & 
lyr of exp, or B.S. in Comp. 
Science or Engg. +5 yrs of pro- 
gressive exp 

Systems Analysts: Design 
implement & support client-serv: 
er packages in core SAP R/3 
includes Basis, Functional 
Workflow, Oracie 8i. Req. 2 yrs 
of exp in job offered 


Send Resume to: Sierra Infosys. 
Inc., 1001 Texas Ave., Ste 310 
jouston TX 77002 or E-mail 
resume@sierratec.com 


Senior Application Analyst 
Programmers R/D call switch 
succession and migration 
strategy, truck and circuit pro- 
visioning for SS7, PRI, DAL, 
Tandem Trunks. Team leader 
to Nortel, Santera VoIP. Batch 
processes and MS project 
Tools PL/SQL Scripts, 
J2/SSE/J2EE, XML, SAX 
and JDBC. Req. BEE with 
4yrs. exp. or as an Application 
Analyst Prog. using above 
tools. Send resume to M 
Amaran, JMA, 10551 Barkley, 
Ste. 400, Overland Park, KS 
66212 





Ads Placed Weekly 





Didn't find the ITCareer opportunity 
you were looking for? 


Check back weekly for 


fresh job listings placed 
by top companies 
looking for skilled IT 


professionals like you! 


Network System Adminis- 
trator: Responsible for in- 
Stallation of comp. hard- 
ware, network systems soft- 
ware applications, mainte- 
nance, monitoring, tuning & 
usage of equipment (ser- 
vers, switches, peripher- 
als). Perform data backups 
& disaster recovery opera- 
tions. Masters degree & re- 
lated exp. reqd. Top $. Mail 
resume to: Color Resource 
Center, Inc. 20 W. 22nd St 
NY, NY 10010 


Seeking qualified applicants for 
the following position in Prince 
ton, NJ: Programmer/Analyst 
Design, develor 

code, implement 

maintain user application 
grams. Modify exis 

tion and provide 

port. Analyze user's re 

to enhance sy 

mance. Req. BS 

C CIS, MIS, ME 

related field with 5 yr. exp. in j 
offered. Must be proficient in 
ERP, SAP and PeopleSoft 
Willing to re-locate in USA as 
needed nd resume 


kumar@e-zencomp.corr 


SAP CONSULTANTS us- 
ing at least 5 skills sets 
Fl, CO, FI-TR, Fl-Plan- 
ning, & HR, SD, MM, PP, 
PP-PI, Am, PM & PS, EDI, 
Basis, QM, WM, BW 
CRM, APO SEM, PLM 
SRM, WAS & Netware 
Technologies. Edu. + 1-5 
yrs. exp. reqd. Mail resu- 
me to: HR, Genesis Corp- 
orate Solutions, LLC, 150 
Presidential Way, Suite 
230, Woburn, MA 01801 





iT|careers 


800-762-2977 
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Technology Project Manager 
Goldman Sachs & Co., New 
York, NY - Manage, evaiuate. 
analyze, implement and support 
database environments for vari- 
ous trading desks and business- 
es. Required: Bachelors degree 
in Computer Science, MIS or 
related field plus five years of 
experience in offered position or 
as systems analyst. Experience 
must include project manage- 
ment experience utilizing UNIX 
Sybase and PERL. Job Code 
TECHO71705PM. Apply: https 
goldmansachs.recruitmax.com: 
eng/candidates/default.cfm using 
Build Your Profile’ option. Can 
didates must provide salary 
Com. 
pensation’ field and specify job 
ode in ‘Specific Type’ field. NO 
PHONE CALLS PLEASE 


requirements in ‘Target 


Software Engineer: Quovadx 
seeks applicants for the posi- 
tion of Software Engineer in 
Boulder, CO to act as a tech- 
nical lead in complete soft 
ware development and imple- 
mentation cycles of computer 
application process software 
Requirements include mas- 
ter’s degree in computer sci- 
ence, 1 yr exp as software en- 
gineer and working knowledge 
of relational database man- 
agement systems, Distributed 
Transaction Processing XA 
protocol, object oriented de- 
sign and programming te 

niques and various compilers 
including HP aCC, GNU C++ 
AIX Visual Age C++ and IRIX 
MiPSpro. Respond by resume 
to Jennifer Tate, Quovadx 
6400 S. Fiddiers Green Circle. 
#1000, Englewood, CO 80111 


COMPUTER SOFTWARE EN- 
GINEER - Design, code, integ- 
rate, implement and support 
web-based applications for Or- 
der entry, billing and other ERP 
modules built using Java/HTML 
2XML Manage Oracle database. 
writing scripts in C++ and other 
languages, stored procedures in 
PL/SQL. Create document pack- 
ets and batch print (mainly 
TIFF/PDF) via daemons/scripts. 
User acceptance testing. B.S. in 
Electronic/Computer Engineer- 
ing. User acceptance testing 
B.S. in Electronic/Computer En- 
gineering. 2 years experience 
40 hours/week.F/T. Please send 
resume to: Compex Legal Ser 
vices, Inc. 325 Maple Ave 
Torrance, Ca 90503. 


Software Engineer: McData 
seeks applicants for the position 
ef Sr. Software Engineer in 
Santa Clara, CA. Design and 
develop embedded manage- 
ment software components for a 
Data Center Class Fibre Chan- 
nel Protocol and SAN switch 
Requirements include master's 
m computer applications or 
computer science and working 
knowledge of Fibre Channel 
Protocol, SNMP, CLI, APIs and 
MIBs. Respond by resume to 
Cherie Henket, McData, 4555 
Great American Parkway, Santa 
Clara, CA 95054 


Computer/bus. Profess'ls for 
long/short term assignments to 
various unanticipated locations 
throughout the U.S. Snr Sales 
Engs. Sell IT, tech’! & bus. pro- 
cess products & svcs requiring 
knowl. of eng’ring & cost effec- 
tive s to global co's. Job 
SEIlI-0802; Bus. System Analys- 
ts Analyze clients business pro- 
cesses, procedures & app's. Job 
BSAIi- 0801. Send cover letter & 
resume to Recruitment Team 
ro Ltd., 1300 Crittenden Ln 
2nd Fi., Mountain View, CA 
94043. Must ref. Job # for con- 
sideration. No calls please. Un- 
restricted permission to work in 
US req'd 
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Database Administrator: Peoria 
IL: Design, develop and main 
tain Relational Databases. An 
alyze, design and develop en 
prise-wide databases to meet 
the client requirements. Monitor 
and maintain database systems 
and provide enhancements for 
future growth. identify, evaluate. 
and implement technical policies 
related to databases. Implement 
necessary administrative proce- 
dures to monitor database sys 
tems. Research new database 
technology and make recom 
mendations for better database 
performance. Tune the datab: 
es for optimal performance and 
customize Oracle zation 
parameters. Install 

base software on different 
forms and apply patches tc 
database. Analyze, design 
velop, implement r 
the backup systems 
prise databases. M 
base from development r 
duction, and migrate the data 
between databases 

shoot databases cor 

issues. 40 hrs/week, 8:30 a. 
to 5:00 p.m. Require Bachelor's 
Degree (*) in Computer Science 
Economics, or equiv., + at least 
1 yr. of work exp. in the job offer 
ed, or at least 1 yr. f work exp 
in the related occupaticn of an 
Oracle DBA. (*) Employer wil 
accept a comb a & exp 
incl. a comb. of multiple } 


rees, or multiple degrees 

exp., for being equiv 
Bachelor's Deg 

work auth. reqd. Send 

of both resume & cover 

Ms. Sharon Bond 

Dynamic Graphics, Inc 

N. Forest Park Dr, Peoria, IL 
61614 


51614 


IT PROFESSIONALS, 
BUSINESS DEVELOPMENT 
MANAGERS 


Majesco Software, Inc., a lead- 
ing software consulting compa 
ny headquartered in Edison, NJ 
seeks computer professionals 
IT Business Development Man- 
agers and IT Project Managers 
For our uter-rela posi 
tions, we are seeking Program 
mer/Analysts, Systems Analysts 
Business Systems Analysts 
Network Engineers and Soft 
ware Engineers. Technical pos 
tions require a bachelor's de 
gree or higher in a related field 
and/or relevant industry expe 
ence. We are also recruiting 

IT Business Developme: 
Account Managers to manage 
existing accounts and all as 
pects of sales/business develop 
ment for the company's 
operations. Qualified applic 

will have a technical and/or rr 
keting degree (master’s 
ferred) and relevant indu 
experience. For our 

Manager positions we prefe 
MS degree in a related 
such as engineering or 

er science and relevant ir 
experience. We w 

applicants with a relevant t 
elor's degree and sigr 
industry experience 

tions are subject to relocatic 
various sites throug 

United States. Qualifie 
cants respond by mail 
Department, Majesce Software 


Sui 
Please specify posit 
for on envelope 


Software Engineers 
lotte, NC. Design, Te 
ment software 
using C, C 
ML, UM 
en, Oracle, PL/SQL, D: 
2000 & Designer 2 
or Equivaient** req 
ers, Engineering 
ed field of study 
exp. (**Eqv: Bachelors 
5 yrs of progressive 
exp.). May be relocate: 
ous unanticipated 
throughout the US. 4( 
Must have legal authority 
work permanently in the U: 
Send resume to HR Manager 
Masterminds Global Solutions 
LLC, 2520 Sardis Road N, Ste 
234, Charlotte, NC 28227 


ars/Wk 


Acme Packet, Inc. seeks appii- 
cants for two engineering posi- 
tions at its Burlington, Ma 
chusetts headquarters 


SOFTWARE ENGINEERING - 
VoIP - Design, development and 
ation of embedded 
ommunication software 
applications in real-time network 
environments. Provide product 
release support and fix defects 
reported by customers or sys- 
tem tests 


Call Signaling Software En- 

gineer (Job Code: CSSE) 
Minim Requirements: Mas- 
f 22 (or equivalent) in 
ter Science or Electron 
ications Engineer 
loyer will also ac- 
achelor's degree (or 

r er S 

ations E 
f pro 
responsible 
n the field 
n 
tevelop- 
e must include 
H.323 and SIP 
system-video/audio 
tandards and transport layers. 
and system to middleware level 


programming in C/C++ 


Protocols Software Engineer 
Job Code: PSE) - Minimum Re 
ents: Master's degree (or 
equivalent) in Computer Science 
or Mechanical Engineering; AND 
two years experience in soft- 
ware design and development 
Experience must include imple- 
menting MGCP, H.323. and 
protocols, system-video/at 
standards and transport layers 
and system to middleware level 


grarning in C/C++ 


Please send resumes to 
Andre Normand 
2ctor of Human Resources 
Acme Packet, Inc 
71 Third Avenue 
Burlington, MA 01803 
Anormand@acmepacket.com 


rogrammer Analysts (P/A) & 
Software Engineers (S/E) for 
L office. P/A: Design & 
velop software applications 
3 Oracle, XML, UML, C++ 
Sybase, interwoven ooigen 
ClearCase, ClearQuest, PVCS 
UNIX. Bachelors or Equivalent 
req'd in Computers, Eng, Math 
related field of study +2 yrs of 
related exp. S/E: Design, Devel- 
9p, Test, Implement, Maintain 
and Coordinate Installation of 
software applications using C 
C++, V Delphi, ASP. XML 
JML, Coolgen, interwove - 
le, PL/SQL, Developer 2000 & 
er 2000; Masters or Equi- 
valent** req'd in Computers, En- 
gineering, math or related field 
of study + 1 yr of related exp 
quivalent: Bachelors or Equ- 
valent + 5 years of progressive 
related work experience). May 
be relocated to various unantici- 
pated locations throughout the 
United States. 40 hrs/Wk. Mi 
have legal authori 
manently in the U.S 
to HR Manager 
nsulting Group 


West, 111th St, Worth 


C 


Programmer Analysts (P/A) & 
Software Engineers (S/E) for 
Edison, NJ. P/A: Design & De- 
slop software applications 
C++, Delphi, ASP, XML 
olgen, Interwoven 
2, PL/SQL, Developer 2000 
Jesigner 2006 Bachelors 
valent req'd in C 
neering, math or related 
f study +2 y f related 
S/E sign, Develop, Test 
lem Maintain and C 
1stallation of softw 


Jo, Ta 
Developer 
2000. Master. 


gressive 
May be relocated to v 
nanticipated lo 
throughout the US. 4 
have legal auth 
permanently in the 
resume to HR 
usiness Consulting 
rogress St, Ste. A-2 
J 08820 
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Outsourcing 


should be more receptive to 
outsourcing, doubts about ex- 
ternal developers persist 
among many managers, who 
fear a loss of control, fallout 
from job cuts and the need to 
ensure data privacy. 

Rick DeMaria, technology 
platform director at mortgage- 
backed securities dealer 
GMAC-RFC Ltd. in Bracknell, 
England, added that IT man- 
agers generally view the skills 
of developers at outsourcing 
companies as limited. 

“The general perception is 
that the typical experience 
with outsourcing is great until 
you try it,” said DeMaria. 
“We've limited our outsourc- 
ing to infrastructure support.” 

“The issues generally are 
that [IT managers are] not 
happy with the outsourcing 
providers” for such tasks, said 
Gartner analyst Kimberly 
Harris-Ferrante. However, she 
said problems aren’t always 
caused by outsourcers but 
rather often stem from a bank 
or insurance company’s lack 
of experience with large out- 
sourcing deals. 

Nonetheless, outsourcing is 
growing, Harris-Ferrante said, 
noting that Gartner expects 
U.S. financial services firms 


SOURCE: GARTNER INC 





to spend an average of $65.6 
million on such services this 
year, up from $53 million in 
2002. Gartner predicts that 
figure will grow to $83.8 mil- 
lion by 2009. 


Careful Approach 
ABN Amro Bank NV, for 
example, last week awarded a 
series of IT outsourcing con- 
tracts worth $2.2 billion to 
IBM, Accenture Ltd. and three 
Indian companies — Infosys 
Technologies Ltd., Tata Con- 
sultancy Services Ltd. and 
Patni Computer Systems Ltd. 
On the other hand, London- 
based Barclays Bank PLC 


NEWS 


| plans to more carefully evalu- 
ate whether projects should 
be outsourced, said Stuart 
Gilmour, head of business de- 
velopment for the bank’s group 
technology office. 

In the past, he said, Bar- 
clays has sent a “reasonable” 
amount of tactical IT and ap- 
plications development work 
to India, but the company is no 
longer approaching outsourc- 
ing as a standard practice. 

“We'll continue to explore 
[outsourcing] where we see 
it being the right thing to do. 
But I think we're getting to 
the point where where [it 
has to be] based on its mer- 
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its,” Gilmour said. 

Meanwhile, some users at | 
the conference said they’re 
creating their own develop- 
ment centers in India to take 
advantage of what they de- 
scribed as cheap, motivated 
and skilled labor. “We went 
the captive route because of 
the span of control we get,” 
said Sean Motley, vice presi- | 
dent of IT at New York-based 
Lehman Brothers Inc.’s invest- 
ment management division. 

Motley said that in February | 
his company launched a “mas- | 
sive” recruiting effort in Mum- | 
bai, India, to staff a new 1,000- | 
person IT and business-proc- | 


essing center there. Several 
Lehman Brothers divisions 
were charged with making 
plans to outsource some IT 
development projects to the 
operation, he said. 

Motley said his unit’s plan 
calls for dispatching its Java 
and .Net application develop- 
ment projects to the Indian 
operations. Each division is re- 
sponsible for the success of its 
own efforts there, he noted. 

Motley added that Lehman 
Brothers still outsources more 
mundane Cobol and DB2 
maintenance and development 
work to providers such as Tata 
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Agile Programmers 
Turning to New Tools 


Begin to accept 
products that 


automate work 


BY HEATHER HAVENSTEIN 
Corporate IT departments 
embracing lightweight agile- 
development methods are in- 
creasingly turning to some 
emerging tools built to work 
within the process. 

Developers using agile pro- 
gramming methodologies 
such as Scrum and extreme 
programming have historically 
eschewed such tools. 

Lightweight agile methods 
typically call for small teams 
to demonstrate new function- 
ality every few weeks, speed- 
ing the development process. 
The methods also eliminate 
extensive documentation and 
call for performing early test- 
ing to simplify development. 

First American Real Estate 
Solutions LP, which collects 
and provides access to real 
estate information, uses a 
Web-based planning, tracking 
and management tool from 
Alpharetta, Ga.-based Version- 
One LLC that’s built for agile 
development. 


For the past five months, 
First American has been 
moving to agile programming 


allows development teams in 
California, North Carolina, 
Florida and India to manage 
requirements, team tasks and 
metrics, said Scott Spencer, 
vice president of engineering 
at the Anaheim, Calif.-based 
company. 


Just the Facts 


Alogent Corp., which de- 
velops payment-processing 
systems for banks, has been 
using VersionOne software 
for the past year as a replace- 
ment for spreadsheets, along 
with Microsoft Project to plan 
and track agile development 
projects. 

The tools make project de- 
tails available to Alogent’s 50 
developers and to others in 
the company, said Ian Culling, 
vice president of product de- 
velopment at the Alpharetta- 
based firm. “The marketing 
group is able to go and take a 
look at the high-level road 
map and can drill down and 
see status of features,” he said. 

“One of the things that kills 





methods. The VersionOne tool 
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agile methods is the fact that 
index cards on a bulletin 
board don’t work to keep peo- 
ple informed as to where you 
are, where you're headed,” 
Culling said. “Now we have a 
single source of information, 
and there is no duplication — 
which was killing us before, 
because you end up making 
decisions based on shaky in- 
formation.” 

Developers at American 
Heritage Life Insurance Co. 
have been using sticky notes, 
whiteboards and spreadsheets | 
to communicate since they be- | 
gan moving to agile develop- | 
ment methods in March, said 
Andy Leonard, SQL server and ! 





database administration man- 
ager at the Jacksonville, Fla.- 
based subsidiary of The All- 
state Corp. The company 
hopes to improve communica- 
tion in March when it deploys 
Microsoft Corp.’s upcoming 
Visual Studio Team System. 

Carey Schwaber, an analyst 
at Forrester Research Inc., said 
that as more companies adopt 
agile methods to get higher- 
quality products to users more 
quickly, development teams 
are adopting tools tailored for 
agile developers. 

And companies are bringing 
out more tools to meet the 
need. For example, Borland 
Software Corp. this week will 
unveil JBuilder 2006, a version 
of its integrated development 
environment that offers new 
peer-to-peer collaboration to 
allow distributed developers 
to view and share source-code 
editors, debuggers and other 
tools in real time, said Rob 
Cheng, Borland’s director of 
product marketing. 

The product targets pro- 
grammers who use agile 
methodologies, Borland said. 

In July, Rally Software De- 
velopment Corp. in Boulder, 
Colo., unveiled the new re- 
lease of its life-cycle manage- 
ment tools for agile teams, and 
VersionOne announced its 
next-generation planning and 
management suite. @ 56590 
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urvival Skills 


HO WILL SURVIVE IN IT? That’s a pretty grim 
way to frame the issue, especially considering re- 
cent good news. IT pay is rising again for some 
skills, according to staffing research firm Foote 
Partners. IT employment keeps inching upward 
— not by much, but at least it hasn’t dropped since March, according 


to the Bureau of Labor Statistics. 


Then again, we’ve all heard the Gartner predictions that IT shops 
will shrink by one-third in the first decade of the 21st century. And 
we've all watched that happening in recent years. 

So, on this Labor Day 2005, it’s no trivial question. Who will sur- 
vive in IT — and how can you be one of the survivors? 


Simple answer: It’s about value. Convince 
your boss that you’re really too valuable to the 
business to let go, and you will survive. 

And how do you do that? The industry deep- 
thinkers will say that you won’t do it by working 
longer hours or choosing the right technical 
skill set or collecting the right credentials. 
That’s the way techies think. And pure techies 
are the IT people who won’t survive. They’re 
doomed, dead men walking, because they’ll 
never figure out that business smarts, not tech- 
nical chops, are what create value in IT today. 

Pure techies don’t see the point in under- 
standing and navigating the labyrinth of office 
politics — why it’s important to know who’s got 
clout, whose users really matter and which 
projects have real backing. It’s too pointlessly 
Machiavellian to them. That’s why they’ll prob- 
ably be blindsided by the next big purge that 
flushes them away. 

And they don’t get why it’s important to 
understand the company they work for and the 
industry their company does business in. So 
they’ll make business-clueless mis- 
takes. They'll meet the specs fox the 
Sarbanes-Oxley project, but it won’t 
pass the audit. They’ll hold off 
rolling out the new sales application 
because some widget isn’t working 
quite right, even though revenue is 
being lost. They'll solve technical 
problems brilliantly but fail to fill 
real business needs. 

They don’t care about how sales 
works, and supply chains, and 
billing, and everything else IT sup- 
ports. They don’t see the big picture 
or the most critical details. So 





FRANK HAYES, Computer- 
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they’ll get the technology right but the business 
part wrong. They won’t add value. And when 
push comes to shove, they won’t survive. 

That’s the conventional wisdom. And it’s half 
right. If you’re a pure techie who truly can’t 
wrap your brain around why business matters, 
you’re an endangered species. 

But if this business stuff just seems illogical, 
chaotic and meaningless compared with the el- 
egant rationality of technology, then there’s still 
hope. So let’s try once more to understand the 
business side — this time in pure techie terms. 

Look at it this way: Your company and indus- 
try are a very badly designed system, built 
piecemeal and wired together in ways that 
work badly, if at all. It’s the worst kind of legacy 
junk — and your job is to keep it running. 

And like most legacy junk, it can’t be re- 
placed wholesale. You can only patch it, repair 
it, devise work-arounds and maybe refactor 
some small piece of the system now and then. 

But before you can keep it running, much less 
ile it, you must understand the system’s 

: operation: the inputs and outputs, 
the bottlenecks and critical paths, 
the operational requirements and 
parameters. 

In other words, you've got to 
know how the business works. 

It’s just one more flaky, cranky, 
kludgy, unreliable, badly docu- 
mented system. But master its 
quirks and intricacies, and you'll 
have a good shot at adding busi- 
ness value after all. 

And just maybe, pure techie or 
not, you'll be a survivor, too. 
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You Just Can’t Be Too Careful 


What a Monday: network glitches, hardware prob- 
lems, and some practical joker has swiped this net 
admin pilot fish's coffee mug, just when he needs it 
most. “Late that morning, | quickly put the case back 
on the server, boot it up, and all is well,” says fish. But 
he gives up on finding the mug - until two weeks later, 
when he traces an awful smell to that server. “I re- 
move the cover and find my mug looking like some 
sort of science experiment gone wrong,” fish reports. 
“That day, we put a lock on the server room door.” 


it Works! how close he 


aoe SHARK came to losing 


nesses TANK. snumott 
a superfast 


and most likely 
losing his job!” 

"Don't Look 

: Behind You 

: New employee com- 

: plains to help desk pilot 

: fish that there’s some- 

: thing wrong with her 

: password. No, it’s not 

: is that whenever | type 

: the password, it just 

: shows stars,” says user. 

: Those asterisks are to 

: protect you, fish ex- 

: plains, so if someone 

? you, they wouldn't be 

? able to read your pass- 

: word. “Yeah,” user says, 

: “but they show up even 

: when there is no one 

; Standing behind me.” 


QUEUE UP A STACK OF your true tales of IT life 

for me at . You'll get 
astylish Shark shirt if | use it. And check out the daily feed, 
browse the Sharkives and sign up for Shark Tank home 
delivery at computerworld.com/sharky. 
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Of course, we've had a 30 year head start. 
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Oracle Fusion Middleware 


Leading Companies Rely on Oracle 
For Business Integration 
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Simplifying Data Management 


Oracle Fusion Middleware. 
Integrate All Your Business Information. 
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